amadey | ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	7e97240fbd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	7e97240fbd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	7e97240fbd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	7e97240fbd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	7e97240fbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	7e97240fbd.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2e1237258b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7e97240fbd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	339c7a9a44.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2876-489-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-493-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-510-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-509-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-508-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-507-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-494-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-656-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-667-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/2876-679-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7e97240fbd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	339c7a9a44.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2e1237258b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7e97240fbd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2e1237258b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	339c7a9a44.exe

Executes dropped EXE 24 IoCs

pid	Process
2888	skotes.exe
2824	9JTVo50.exe
1016	WkfyDiO.exe
1460	713607610a.exe
3040	c495383506.exe
2528	2e1237258b.exe
2448	7e97240fbd.exe
2100	339c7a9a44.exe
1356	52360aae00.exe
1692	24d662831e.exe
2368	788ffd189f.exe
2016	24d662831e.exe
2068	24d662831e.exe
2472	7z.exe
2716	7z.exe
1040	7z.exe
2980	7z.exe
2056	7z.exe
1348	7z.exe
1064	7z.exe
2608	7z.exe
1156	in.exe
2492	Intel_PTT_EK_Recertification.exe
4084	Intel_PTT_EK_Recertification.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	7e97240fbd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	339c7a9a44.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	2e1237258b.exe

Loads dropped DLL 46 IoCs

pid	Process
2220	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
2888	skotes.exe
2888	skotes.exe
1016	WkfyDiO.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
2888	skotes.exe
1692	24d662831e.exe
1692	24d662831e.exe
1032	cmd.exe
2472	7z.exe
1032	cmd.exe
2716	7z.exe
1032	cmd.exe
1040	7z.exe
1032	cmd.exe
2980	7z.exe
1032	cmd.exe
2056	7z.exe
1032	cmd.exe
1348	7z.exe
1032	cmd.exe
1064	7z.exe
1032	cmd.exe
2608	7z.exe
1032	cmd.exe
1032	cmd.exe
1572	taskeng.exe
1572	taskeng.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
3060	WerFault.exe
2100	339c7a9a44.exe
1572	taskeng.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	7e97240fbd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	7e97240fbd.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\c495383506.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014617001\\c495383506.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\2e1237258b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014618001\\2e1237258b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\7e97240fbd.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1014619001\\7e97240fbd.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0005000000019d6d-86.dat	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
888	tasklist.exe
3844	tasklist.exe
2268	tasklist.exe
2288	tasklist.exe
276	tasklist.exe
2032	tasklist.exe
2100	tasklist.exe
2212	tasklist.exe
3088	tasklist.exe
2308	tasklist.exe
4028	tasklist.exe
2932	tasklist.exe
2384	tasklist.exe
4056	tasklist.exe
2988	tasklist.exe
3384	tasklist.exe
648	tasklist.exe
2500	tasklist.exe
2140	tasklist.exe
3948	tasklist.exe
1592	tasklist.exe
1296	tasklist.exe
2596	tasklist.exe
1940	tasklist.exe
3484	tasklist.exe
1940	tasklist.exe
3260	tasklist.exe
3500	tasklist.exe
1800	tasklist.exe
2984	tasklist.exe
2000	tasklist.exe
2448	tasklist.exe
1688	tasklist.exe
1348	tasklist.exe
1740	tasklist.exe
2600	tasklist.exe
3364	tasklist.exe
3332	tasklist.exe
3140	tasklist.exe
2724	tasklist.exe
1520	tasklist.exe
2936	tasklist.exe
3556	tasklist.exe
3384	tasklist.exe
3672	tasklist.exe
3980	tasklist.exe
2128	tasklist.exe
2216	tasklist.exe
2348	tasklist.exe
2500	tasklist.exe
3060	tasklist.exe
4040	tasklist.exe
3308	tasklist.exe
2288	tasklist.exe
336	tasklist.exe
1800	tasklist.exe
3344	tasklist.exe
3556	tasklist.exe
3708	tasklist.exe
3736	tasklist.exe
4088	tasklist.exe
3784	tasklist.exe
3980	tasklist.exe
3012	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2220	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
2888	skotes.exe
2528	2e1237258b.exe
2448	7e97240fbd.exe
2100	339c7a9a44.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 2068	1692	24d662831e.exe	70
PID 2492 set thread context of 2876	2492	Intel_PTT_EK_Recertification.exe	221
PID 4084 set thread context of 3992	4084	Intel_PTT_EK_Recertification.exe	301

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1156-311-0x000000013F610000-0x000000013FAA0000-memory.dmp	upx
behavioral1/memory/1156-310-0x000000013F610000-0x000000013FAA0000-memory.dmp	upx
behavioral1/memory/2492-512-0x000000013FA80000-0x000000013FF10000-memory.dmp	upx
behavioral1/memory/2492-521-0x000000013FA80000-0x000000013FF10000-memory.dmp	upx
behavioral1/memory/4084-992-0x000000013F760000-0x000000013FBF0000-memory.dmp	upx
behavioral1/memory/4084-999-0x000000013F760000-0x000000013FBF0000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2824	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e1237258b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52360aae00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	c495383506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24d662831e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	713607610a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c495383506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	788ffd189f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	339c7a9a44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	c495383506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e97240fbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24d662831e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9JTVo50.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1704	PING.EXE
2896	powershell.exe
1016	PING.EXE
1276	powershell.exe
3176	PING.EXE
4076	powershell.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	788ffd189f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	788ffd189f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Delays execution with timeout.exe 64 IoCs

pid	Process
3244	timeout.exe
964	timeout.exe
2948	timeout.exe
3528	timeout.exe
2876	timeout.exe
1688	timeout.exe
2212	timeout.exe
3084	timeout.exe
2240	timeout.exe
3200	timeout.exe
3368	timeout.exe
2372	timeout.exe
3992	timeout.exe
2292	timeout.exe
956	timeout.exe
2264	timeout.exe
832	timeout.exe
3296	timeout.exe
936	timeout.exe
1096	timeout.exe
3368	timeout.exe
2384	timeout.exe
3464	timeout.exe
2088	timeout.exe
3784	timeout.exe
2024	timeout.exe
4044	timeout.exe
3408	timeout.exe
2472	timeout.exe
3296	timeout.exe
1484	timeout.exe
2280	timeout.exe
1572	timeout.exe
900	timeout.exe
3820	timeout.exe
3424	timeout.exe
2760	timeout.exe
2228	timeout.exe
3980	timeout.exe
2420	timeout.exe
1692	timeout.exe
1960	timeout.exe
3552	timeout.exe
860	timeout.exe
3696	timeout.exe
3988	timeout.exe
1056	timeout.exe
4048	timeout.exe
2364	timeout.exe
3136	timeout.exe
2744	timeout.exe
3256	timeout.exe
1596	timeout.exe
2132	timeout.exe
2052	timeout.exe
2988	timeout.exe
2364	timeout.exe
2000	timeout.exe
3964	timeout.exe
2340	timeout.exe
2140	timeout.exe
1156	timeout.exe
3192	timeout.exe
3712	timeout.exe

Kills process with taskkill 10 IoCs

pid	Process
1512	taskkill.exe
1728	taskkill.exe
2144	taskkill.exe
1612	taskkill.exe
3716	taskkill.exe
3556	taskkill.exe
2020	taskkill.exe
2556	taskkill.exe
1340	taskkill.exe
1600	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	788ffd189f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	788ffd189f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	788ffd189f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	24d662831e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	24d662831e.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1016	PING.EXE
3176	PING.EXE
1704	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2220	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
2888	skotes.exe
1016	WkfyDiO.exe
2528	2e1237258b.exe
2448	7e97240fbd.exe
2100	339c7a9a44.exe
2448	7e97240fbd.exe
2448	7e97240fbd.exe
3040	c495383506.exe
2896	powershell.exe
3040	c495383506.exe
2492	Intel_PTT_EK_Recertification.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
1276	powershell.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
2368	788ffd189f.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
4084	Intel_PTT_EK_Recertification.exe
4076	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	WkfyDiO.exe
Token: SeDebugPrivilege	1940	tasklist.exe
Token: SeDebugPrivilege	2132	tasklist.exe
Token: SeDebugPrivilege	2348	tasklist.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	2384	tasklist.exe
Token: SeDebugPrivilege	2448	7e97240fbd.exe
Token: SeDebugPrivilege	1800	tasklist.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	2500	tasklist.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeRestorePrivilege	2472	7z.exe
Token: 35	2472	7z.exe
Token: SeSecurityPrivilege	2472	7z.exe
Token: SeSecurityPrivilege	2472	7z.exe
Token: SeDebugPrivilege	3060	tasklist.exe
Token: SeRestorePrivilege	2716	7z.exe
Token: 35	2716	7z.exe
Token: SeSecurityPrivilege	2716	7z.exe
Token: SeSecurityPrivilege	2716	7z.exe
Token: SeRestorePrivilege	1040	7z.exe
Token: 35	1040	7z.exe
Token: SeSecurityPrivilege	1040	7z.exe
Token: SeSecurityPrivilege	1040	7z.exe
Token: SeRestorePrivilege	2980	7z.exe
Token: 35	2980	7z.exe
Token: SeSecurityPrivilege	2980	7z.exe
Token: SeSecurityPrivilege	2980	7z.exe
Token: SeRestorePrivilege	2056	7z.exe
Token: 35	2056	7z.exe
Token: SeSecurityPrivilege	2056	7z.exe
Token: SeSecurityPrivilege	2056	7z.exe
Token: SeRestorePrivilege	1348	7z.exe
Token: 35	1348	7z.exe
Token: SeSecurityPrivilege	1348	7z.exe
Token: SeSecurityPrivilege	1348	7z.exe
Token: SeRestorePrivilege	1064	7z.exe
Token: 35	1064	7z.exe
Token: SeSecurityPrivilege	1064	7z.exe
Token: SeSecurityPrivilege	1064	7z.exe
Token: SeRestorePrivilege	2608	7z.exe
Token: 35	2608	7z.exe
Token: SeSecurityPrivilege	2608	7z.exe
Token: SeSecurityPrivilege	2608	7z.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	2724	tasklist.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	888	tasklist.exe
Token: SeDebugPrivilege	1824	firefox.exe
Token: SeDebugPrivilege	1824	firefox.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	3484	tasklist.exe
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	3948	tasklist.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeLockMemoryPrivilege	2876	explorer.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeDebugPrivilege	3716	taskkill.exe
Token: SeDebugPrivilege	1340	taskkill.exe
Token: SeDebugPrivilege	3548	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2220	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
3040	c495383506.exe
1824	firefox.exe
1824	firefox.exe
1824	firefox.exe
3040	c495383506.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2888	2220	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe	29
PID 2220 wrote to memory of 2888	2220	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe	29
PID 2220 wrote to memory of 2888	2220	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe	29
PID 2220 wrote to memory of 2888	2220	ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe	29
PID 2888 wrote to memory of 2824	2888	skotes.exe	31
PID 2888 wrote to memory of 2824	2888	skotes.exe	31
PID 2888 wrote to memory of 2824	2888	skotes.exe	31
PID 2888 wrote to memory of 2824	2888	skotes.exe	31
PID 2888 wrote to memory of 1016	2888	skotes.exe	32
PID 2888 wrote to memory of 1016	2888	skotes.exe	32
PID 2888 wrote to memory of 1016	2888	skotes.exe	32
PID 2888 wrote to memory of 1016	2888	skotes.exe	32
PID 1016 wrote to memory of 2672	1016	WkfyDiO.exe	33
PID 1016 wrote to memory of 2672	1016	WkfyDiO.exe	33
PID 1016 wrote to memory of 2672	1016	WkfyDiO.exe	33
PID 2888 wrote to memory of 1460	2888	skotes.exe	35
PID 2888 wrote to memory of 1460	2888	skotes.exe	35
PID 2888 wrote to memory of 1460	2888	skotes.exe	35
PID 2888 wrote to memory of 1460	2888	skotes.exe	35
PID 2672 wrote to memory of 1980	2672	cmd.exe	36
PID 2672 wrote to memory of 1980	2672	cmd.exe	36
PID 2672 wrote to memory of 1980	2672	cmd.exe	36
PID 2672 wrote to memory of 1940	2672	cmd.exe	37
PID 2672 wrote to memory of 1940	2672	cmd.exe	37
PID 2672 wrote to memory of 1940	2672	cmd.exe	37
PID 2672 wrote to memory of 1964	2672	cmd.exe	38
PID 2672 wrote to memory of 1964	2672	cmd.exe	38
PID 2672 wrote to memory of 1964	2672	cmd.exe	38
PID 2888 wrote to memory of 3040	2888	skotes.exe	40
PID 2888 wrote to memory of 3040	2888	skotes.exe	40
PID 2888 wrote to memory of 3040	2888	skotes.exe	40
PID 2888 wrote to memory of 3040	2888	skotes.exe	40
PID 2672 wrote to memory of 2144	2672	cmd.exe	67
PID 2672 wrote to memory of 2144	2672	cmd.exe	67
PID 2672 wrote to memory of 2144	2672	cmd.exe	67
PID 2672 wrote to memory of 2132	2672	cmd.exe	42
PID 2672 wrote to memory of 2132	2672	cmd.exe	42
PID 2672 wrote to memory of 2132	2672	cmd.exe	42
PID 2672 wrote to memory of 900	2672	cmd.exe	43
PID 2672 wrote to memory of 900	2672	cmd.exe	43
PID 2672 wrote to memory of 900	2672	cmd.exe	43
PID 2888 wrote to memory of 2528	2888	skotes.exe	44
PID 2888 wrote to memory of 2528	2888	skotes.exe	44
PID 2888 wrote to memory of 2528	2888	skotes.exe	44
PID 2888 wrote to memory of 2528	2888	skotes.exe	44
PID 2672 wrote to memory of 936	2672	cmd.exe	45
PID 2672 wrote to memory of 936	2672	cmd.exe	45
PID 2672 wrote to memory of 936	2672	cmd.exe	45
PID 2672 wrote to memory of 2348	2672	cmd.exe	46
PID 2672 wrote to memory of 2348	2672	cmd.exe	46
PID 2672 wrote to memory of 2348	2672	cmd.exe	46
PID 2672 wrote to memory of 1252	2672	cmd.exe	47
PID 2672 wrote to memory of 1252	2672	cmd.exe	47
PID 2672 wrote to memory of 1252	2672	cmd.exe	47
PID 3040 wrote to memory of 1512	3040	c495383506.exe	48
PID 3040 wrote to memory of 1512	3040	c495383506.exe	48
PID 3040 wrote to memory of 1512	3040	c495383506.exe	48
PID 3040 wrote to memory of 1512	3040	c495383506.exe	48
PID 2888 wrote to memory of 2448	2888	skotes.exe	50
PID 2888 wrote to memory of 2448	2888	skotes.exe	50
PID 2888 wrote to memory of 2448	2888	skotes.exe	50
PID 2888 wrote to memory of 2448	2888	skotes.exe	50
PID 2672 wrote to memory of 2876	2672	cmd.exe	122
PID 2672 wrote to memory of 2876	2672	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
1452	attrib.exe
2024	attrib.exe
1996	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe
"C:\Users\Admin\AppData\Local\Temp\ac7eab26629e889c428293f303b428424ffccae5658636cca54512753fa2792a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\1014564001\9JTVo50.exe
    "C:\Users\Admin\AppData\Local\Temp\1014564001\9JTVo50.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 44
      4⤵
      Loads dropped DLL
      Program crash
      PID:3060
- - C:\Users\Admin\AppData\Local\Temp\1014611001\WkfyDiO.exe
    "C:\Users\Admin\AppData\Local\Temp\1014611001\WkfyDiO.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp4F0.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp4F0.tmp.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1980
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1964
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2144
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:900
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:936
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1252
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2876
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2028
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2988
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2024
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1572
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1936
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1548
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3068
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1096
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:560
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1596
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2372
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2364
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1280
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3192
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3484
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3492
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3796
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3844
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3852
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3888
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3956
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3992
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2712
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:900
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3364
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3380
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3368
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3576
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3712
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3424
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2132
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:1988
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2060
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1056
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:1592
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2124
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3980
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2448
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2164
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2000
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2288
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3052
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2472
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3736
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2756
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1980
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:4088
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1384
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4044
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:4056
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3988
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4048
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:1520
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2932
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3964
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:4040
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2236
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1960
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:1688
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3004
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2292
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3088
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3248
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3120
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3308
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3132
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2340
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2000
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3204
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:564
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2288
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2808
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3296
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:576
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2724
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2372
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:3640
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3596
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2420
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3384
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3368
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:2876
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:3672
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3668
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2052
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:1348
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1340
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:956
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2988
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3344
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3408
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:1512
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2700
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3820
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2216
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1740
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1484
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2308
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1668
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3552
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3784
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3812
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2364
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:1940
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1460
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3136
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3332
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2236
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1688
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3980
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2292
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3244
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:1736
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2296
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2280
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3140
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2732
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2140
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:336
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2868
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:860
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:276
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3520
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2212
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:3584
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2560
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3464
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3384
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1140
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3696
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3672
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3236
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3424
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:1800
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3608
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:964
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:2612
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1616
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2948
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2032
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2584
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2760
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2100
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3616
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1856
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3344
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1932
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1692
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3556
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2700
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2744
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:1740
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3708
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2088
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:4028
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3552
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3784
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:3812
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1056
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3988
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2932
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3340
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2264
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3980
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3004
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3256
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3260
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1604
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3084
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:2340
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2444
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:832
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:648
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:932
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3740
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2500
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:384
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3296
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2140
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2724
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1156
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:860
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2372
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3520
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2212
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2356
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3528
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3500
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3460
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3368
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:1296
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3696
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2024
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:1892
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3700
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1348
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2596
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:1340
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2240
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:3580
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3444
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:1376
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2936
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2612
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2384
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3012
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2028
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2228
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        
        PID:3760
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2100
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3600
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:2600
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:3344
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3156
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3556
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2700
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        
        PID:3808
    - - C:\Windows\system32\tasklist.exe
        
        Tasklist /fi "PID eq 1016"
        5⤵
        Enumerates processes with tasklist
        
        PID:3708
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:2412
    - - C:\Windows\system32\timeout.exe
        
        Timeout /T 1 /Nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3200
- - C:\Users\Admin\AppData\Local\Temp\1014616001\713607610a.exe
    "C:\Users\Admin\AppData\Local\Temp\1014616001\713607610a.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1460
- - C:\Users\Admin\AppData\Local\Temp\1014617001\c495383506.exe
    "C:\Users\Admin\AppData\Local\Temp\1014617001\c495383506.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1612
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:1600
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1824
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.0.1453130444\33322572" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1228 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0f23ca8-e500-4b85-8427-d11005fd34d6} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 1348 10ad7d58 gpu
        6⤵
        
        PID:3016
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.1.397569207\1199055691" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1504 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d3d7892-50ef-4e9d-81e1-eea7fe558600} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 1536 d73e58 socket
        6⤵
        
        PID:2452
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.2.1944344091\145369041" -childID 1 -isForBrowser -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 556 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {402202ea-5e62-491b-9ba0-6a315656ddea} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 2336 198b7958 tab
        6⤵
        
        PID:972
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.3.1305906211\86010931" -childID 2 -isForBrowser -prefsHandle 2820 -prefMapHandle 2816 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 556 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1f6c900-5cef-4ab7-bc66-fae8e3a76a5f} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 2832 d63b58 tab
        6⤵
        
        PID:1596
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.4.74282636\647105075" -childID 3 -isForBrowser -prefsHandle 3784 -prefMapHandle 3780 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 556 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efbea523-fdc7-4732-b1a9-999d38f1306c} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 3796 d5fb58 tab
        6⤵
        
        PID:3388
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.5.1979084330\1216167924" -childID 4 -isForBrowser -prefsHandle 3904 -prefMapHandle 3908 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 556 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5569d84c-d494-4841-bd93-343196f4ab56} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 3892 1f042a58 tab
        6⤵
        
        PID:3396
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1824.6.1765997749\311543446" -childID 5 -isForBrowser -prefsHandle 4060 -prefMapHandle 4064 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 556 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a438c3e-7486-4f6f-9f76-65cf3bcdccc6} 1824 "\\.\pipe\gecko-crash-server-pipe.1824" 4048 16ef8e58 tab
        6⤵
        
        PID:3404
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:1600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:3504
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        
        PID:3488
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3488.0.403238322\1413268005" -parentBuildID 20221007134813 -prefsHandle 1200 -prefMapHandle 1180 -prefsLen 21072 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b02b929b-798e-4ff3-8c69-3ce8e39fcedb} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" 1292 139f6258 gpu
        6⤵
        
        PID:3160
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3488.1.896194426\526058364" -parentBuildID 20221007134813 -prefsHandle 1480 -prefMapHandle 1476 -prefsLen 21933 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cc7a926-155b-4661-8878-a35fe397426f} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" 1492 e8db258 socket
        6⤵
        
        PID:2040
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3488.2.736133508\91002462" -childID 1 -isForBrowser -prefsHandle 1976 -prefMapHandle 1972 -prefsLen 21971 -prefMapSize 233496 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {604e87bf-82c6-46b6-99bd-d5d45c4ae2c8} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" 2364 197b2158 tab
        6⤵
        
        PID:2544
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3488.3.1071549950\1868657262" -childID 2 -isForBrowser -prefsHandle 2892 -prefMapHandle 2888 -prefsLen 26351 -prefMapSize 233496 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4d007d6-d037-4fe9-be14-715fb19769c4} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" 2912 1bee0058 tab
        6⤵
        
        PID:3416
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3488.4.2071297413\644719317" -childID 3 -isForBrowser -prefsHandle 3572 -prefMapHandle 3824 -prefsLen 26531 -prefMapSize 233496 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3e2be72-2a5d-4a54-8b98-37e5842b184e} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" 3692 207f2358 tab
        6⤵
        
        PID:3804
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3488.5.1490084046\669580083" -childID 4 -isForBrowser -prefsHandle 3836 -prefMapHandle 3900 -prefsLen 26531 -prefMapSize 233496 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1776b22e-a7b2-42e4-8909-f22ee6d99871} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" 3584 207f1a58 tab
        6⤵
        
        PID:3864
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3488.6.1939852578\199146714" -childID 5 -isForBrowser -prefsHandle 4076 -prefMapHandle 4080 -prefsLen 26531 -prefMapSize 233496 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f62d5694-c2a2-438c-abc4-9b482c3a88c3} 3488 "\\.\pipe\gecko-crash-server-pipe.3488" 4064 207f3858 tab
        6⤵
        
        PID:1276
- - C:\Users\Admin\AppData\Local\Temp\1014618001\2e1237258b.exe
    "C:\Users\Admin\AppData\Local\Temp\1014618001\2e1237258b.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\1014619001\7e97240fbd.exe
    "C:\Users\Admin\AppData\Local\Temp\1014619001\7e97240fbd.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\1014620001\339c7a9a44.exe
    "C:\Users\Admin\AppData\Local\Temp\1014620001\339c7a9a44.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\1014621001\52360aae00.exe
    "C:\Users\Admin\AppData\Local\Temp\1014621001\52360aae00.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1356
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      PID:1032
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:1156
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:1996
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:2024
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2156
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1016
- - C:\Users\Admin\AppData\Local\Temp\1014622001\24d662831e.exe
    "C:\Users\Admin\AppData\Local\Temp\1014622001\24d662831e.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\1014622001\24d662831e.exe
      "C:\Users\Admin\AppData\Local\Temp\1014622001\24d662831e.exe"
      4⤵
      Executes dropped EXE
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\1014622001\24d662831e.exe
      "C:\Users\Admin\AppData\Local\Temp\1014622001\24d662831e.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:2068
- - C:\Users\Admin\AppData\Local\Temp\1014623001\788ffd189f.exe
    "C:\Users\Admin\AppData\Local\Temp\1014623001\788ffd189f.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:2368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014623001\788ffd189f.exe" & rd /s /q "C:\ProgramData\TR9Z5XBSR1N7" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:3180
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3484

C:\Windows\system32\taskeng.exe
taskeng.exe {2060942B-5B54-40EE-8DB5-62DD62B2D205} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:1572
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3176
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:3992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4076
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1704

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-6911515151557920914-793699292-35491388723363661-437905389-11560325521369427349"
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion