asyncrat | 31a6ae954de5d6d0826b2665369588d62d31d9bb3714ad2c6b38c2d965138b84

Processes:

MONITRGB.EXEsvhtiwes.exechromes.exeSERVWINLE.EXEchromes.exechromes.exechromes.exechromes.exemscalc.EXEMONITRGB.EXEchromes.exechromes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\GDezTerjNyCW.exe\",explorer.exe"	MONITRGB.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\winskype.exe,C:\\Users\\Admin\\Documents\\skype64.exe"	svhtiwes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\U0lsDCEH1W0E.exe\",explorer.exe"	chromes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\winskype.exe,C:\\Users\\Admin\\Documents\\skype64.exe,C:\\Users\\Admin\\Documents\\rarl.exe"	SERVWINLE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\678VyoPwcCGd.exe\",explorer.exe"	chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\wKk1nrfWDKcY.exe\",explorer.exe"	chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\iNqyu1I1vFGl.exe\",explorer.exe"	chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\ZejH0Bbrlgrb.exe\",explorer.exe"	chromes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\winskype.exe"	mscalc.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\BdjJ0JkftEtk.exe\",explorer.exe"	MONITRGB.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\ku3NZYtRIpyU.exe\",explorer.exe"	chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MZIf3KrY2sjC9740\\8yvzgojZWYj8.exe\",explorer.exe"	chromes.exe

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 5108 created 4076 5108 WerFault.exe WINDRVAMS.EXE
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

description	pid	process	target process
PID 5108 created 4076	5108	WerFault.exe	WINDRVAMS.EXE

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4092-109-0x0000000007270000-0x000000000727C000-memory.dmp	asyncrat

Warzone RAT Payload 12 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4660-126-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4660-127-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/4660-133-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2888-147-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3952-156-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3952-160-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/2888-149-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/3952-170-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2888-167-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4360-282-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/1548-288-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/4356-290-0x0000000000405CE2-mapping.dmp	warzonerat

Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 3 IoCs

Processes:

svhtiwes.exeSERVWINLE.EXEmscalc.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svhtiwes.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	SERVWINLE.EXE
File opened for modification	C:\Windows\system32\drivers\etc\hosts	mscalc.EXE

Executes dropped EXE 61 IoCs

Processes:

AMDCPUL.EXEAUDIOMLE.EXEMONITRGB.EXESERVWINLE.EXETVLSWPLE.EXEVIDEOGPU.EXEWINDRVAMS.EXEwinskype.exesvhtiwes.exeskype64.exechromes.exechromes.exechromes.exechromes.exechromes.exechromes.exesvhtiwes.exewinsers.exewinsers.exechromes.exechromes.exeimagles.exechromes.exechromes.exeTVLSWPLE.EXEchromes.exechromes.exeSERVWINLE.EXEVIDEOGPU.EXEchromes.exerarl.exewinskype.EXEsvnhost.exeAMDCPUL.EXEAUDIOMLE.EXEMONITRGB.EXESERVWINLE.EXETVLSWPLE.EXEVIDEOGPU.EXEWINDRVAMS.EXEchromes.exechromes.exeamdvideol.exesvhtiwes.exechromes.exechromes.exerarl.EXEchromes.exechromes.exechromes.exesvnhost.EXESERVWINLE.EXETVLSWPLE.EXEVIDEOGPU.EXEchromes.exechromes.exechromes.exechromes.exewinsers.exeamdvideol.exewinsers.exe

pid	process
4072	AMDCPUL.EXE
4092	AUDIOMLE.EXE
1856	MONITRGB.EXE
4508	SERVWINLE.EXE
4464	TVLSWPLE.EXE
4556	VIDEOGPU.EXE
4572	WINDRVAMS.EXE
1448	winskype.exe
664	svhtiwes.exe
4808	skype64.exe
4256	chromes.exe
4268	chromes.exe
4284	chromes.exe
2644	chromes.exe
560	chromes.exe
4180	chromes.exe
4856	svhtiwes.exe
592	winsers.exe
4660	winsers.exe
1896	chromes.exe
1184	chromes.exe
2364	imagles.exe
3144	chromes.exe
216	chromes.exe
2888	TVLSWPLE.EXE
204	chromes.exe
2500	chromes.exe
196	SERVWINLE.EXE
3952	VIDEOGPU.EXE
4348	chromes.exe
4400	rarl.exe
4944	winskype.EXE
4156	svnhost.exe
3256	AMDCPUL.EXE
4796	AUDIOMLE.EXE
3924	MONITRGB.EXE
4852	SERVWINLE.EXE
3464	TVLSWPLE.EXE
4664	VIDEOGPU.EXE
4076	WINDRVAMS.EXE
3032	chromes.exe
968	chromes.exe
4128	amdvideol.exe
4712	svhtiwes.exe
192	chromes.exe
3900	chromes.exe
4532	rarl.EXE
2904	chromes.exe
604	chromes.exe
1668	chromes.exe
4360	svnhost.EXE
3372	SERVWINLE.EXE
1548	TVLSWPLE.EXE
4356	VIDEOGPU.EXE
3272	chromes.exe
4436	chromes.exe
4244	chromes.exe
4848	chromes.exe
4340	winsers.exe
2220	amdvideol.exe
4032	winsers.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/664-67-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/664-77-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/4856-115-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/196-154-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/196-169-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

mscalc.EXEsvhtiwes.exeSERVWINLE.EXE

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	mscalc.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	svhtiwes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	SERVWINLE.EXE

Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

384 notepad.exe

pid	process
384	notepad.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

TVLSWPLE.EXESERVWINLE.EXErarl.EXETVLSWPLE.EXEsvhtiwes.exewinsers.exeVIDEOGPU.EXEmscalc.EXEsvhtiwes.exewinskype.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\wProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\uniPlayer\\uniPlayer.exe.exe"	TVLSWPLE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\winrars = "C:\\Users\\Admin\\Documents\\rarl.exe"	SERVWINLE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\winrars = "C:\\Users\\Admin\\Documents\\rarl.exe"	rarl.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	TVLSWPLE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\wProPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\uniPlayer\\uniPlayer.exe.exe"	TVLSWPLE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\skypen = "C:\\Users\\Admin\\Documents\\skype64.exe"	svhtiwes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Imagles = "C:\\ProgramData\\imagles.exe"	winsers.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	TVLSWPLE.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windrva = "C:\\ProgramData\\svnhost.exe"	VIDEOGPU.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\skypes = "C:\\Users\\Admin\\Documents\\winskype.exe"	mscalc.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\skypen = "C:\\Users\\Admin\\Documents\\skype64.exe"	svhtiwes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\skypes = "C:\\Users\\Admin\\Documents\\winskype.exe"	winskype.EXE

Maps connected drives based on registry 3 TTPs 16 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

VIDEOGPU.EXESERVWINLE.EXESERVWINLE.EXETVLSWPLE.EXETVLSWPLE.EXEVIDEOGPU.EXErarl.exesvnhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	VIDEOGPU.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SERVWINLE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SERVWINLE.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	SERVWINLE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	TVLSWPLE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	VIDEOGPU.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	TVLSWPLE.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	SERVWINLE.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	VIDEOGPU.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	rarl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	TVLSWPLE.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	rarl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	TVLSWPLE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	VIDEOGPU.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	svnhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	svnhost.exe

Suspicious use of SetThreadContext 25 IoCs

Processes:

mscalc.exeAMDCPUL.EXEMONITRGB.EXEskype64.exeWINDRVAMS.EXEchromes.exeTVLSWPLE.EXEchromes.exeSERVWINLE.EXEVIDEOGPU.EXEwinskype.exechromes.exeAMDCPUL.EXEMONITRGB.EXErarl.exechromes.exesvnhost.exeSERVWINLE.EXETVLSWPLE.EXEVIDEOGPU.EXEchromes.exechromes.exechromes.exeWINDRVAMS.EXEimagles.exe

description	pid	process	target process
PID 4764 set thread context of 4080	4764	mscalc.exe	mscalc.EXE
PID 4072 set thread context of 664	4072	AMDCPUL.EXE	svhtiwes.exe
PID 1856 set thread context of 560	1856	MONITRGB.EXE	chromes.exe
PID 4808 set thread context of 4856	4808	skype64.exe	svhtiwes.exe
PID 4572 set thread context of 4660	4572	WINDRVAMS.EXE	winsers.exe
PID 4180 set thread context of 1896	4180	chromes.exe	chromes.exe
PID 4464 set thread context of 2888	4464	TVLSWPLE.EXE	TVLSWPLE.EXE
PID 1184 set thread context of 2500	1184	chromes.exe	chromes.exe
PID 4508 set thread context of 196	4508	SERVWINLE.EXE	SERVWINLE.EXE
PID 4556 set thread context of 3952	4556	VIDEOGPU.EXE	VIDEOGPU.EXE
PID 1448 set thread context of 4944	1448	winskype.exe	winskype.EXE
PID 4348 set thread context of 3032	4348	chromes.exe	chromes.exe
PID 3256 set thread context of 4712	3256	AMDCPUL.EXE	svhtiwes.exe
PID 3924 set thread context of 192	3924	MONITRGB.EXE	chromes.exe
PID 4400 set thread context of 4532	4400	rarl.exe	rarl.EXE
PID 968 set thread context of 604	968	chromes.exe	chromes.exe
PID 4156 set thread context of 4360	4156	svnhost.exe	svnhost.EXE
PID 4852 set thread context of 3372	4852	SERVWINLE.EXE	SERVWINLE.EXE
PID 3464 set thread context of 1548	3464	TVLSWPLE.EXE	TVLSWPLE.EXE
PID 4664 set thread context of 4356	4664	VIDEOGPU.EXE	VIDEOGPU.EXE
PID 3900 set thread context of 3272	3900	chromes.exe	chromes.exe
PID 1668 set thread context of 4244	1668	chromes.exe	chromes.exe
PID 4436 set thread context of 4848	4436	chromes.exe	chromes.exe
PID 4076 set thread context of 4340	4076	WINDRVAMS.EXE	winsers.exe
PID 2364 set thread context of 4032	2364	imagles.exe	winsers.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4344	4072	WerFault.exe	AMDCPUL.EXE
4936	4808	WerFault.exe	skype64.exe
4052	4572	WerFault.exe	WINDRVAMS.EXE
4676	3256	WerFault.exe	AMDCPUL.EXE
2136	4076	WerFault.exe	WINDRVAMS.EXE
5108	4076	WerFault.exe	WINDRVAMS.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

AcroRd32.exeAcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

876 schtasks.exe
4480 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

5068 timeout.exe
3004 timeout.exe

pid	process
876	schtasks.exe
4480	schtasks.exe

pid	process
5068	timeout.exe
3004	timeout.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 5 IoCs

Processes:

mscalc.EXEsvhtiwes.exeSERVWINLE.EXEwinskype.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	mscalc.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	mscalc.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	svhtiwes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	SERVWINLE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	winskype.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AMDCPUL.EXEWerFault.exeMONITRGB.EXEAcroRd32.exeskype64.exeWerFault.exe

pid	process
4072	AMDCPUL.EXE
4072	AMDCPUL.EXE
4072	AMDCPUL.EXE
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
4344	WerFault.exe
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
1856	MONITRGB.EXE
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
4808	skype64.exe
4808	skype64.exe
4808	skype64.exe
4936	WerFault.exe
4936	WerFault.exe
4936	WerFault.exe
4936	WerFault.exe
4936	WerFault.exe
4936	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

mscalc.EXEAMDCPUL.EXEsvhtiwes.exeWerFault.exeMONITRGB.EXEAUDIOMLE.EXEchromes.exeskype64.exesvhtiwes.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4080	mscalc.EXE
Token: SeSecurityPrivilege	4080	mscalc.EXE
Token: SeTakeOwnershipPrivilege	4080	mscalc.EXE
Token: SeLoadDriverPrivilege	4080	mscalc.EXE
Token: SeSystemProfilePrivilege	4080	mscalc.EXE
Token: SeSystemtimePrivilege	4080	mscalc.EXE
Token: SeProfSingleProcessPrivilege	4080	mscalc.EXE
Token: SeIncBasePriorityPrivilege	4080	mscalc.EXE
Token: SeCreatePagefilePrivilege	4080	mscalc.EXE
Token: SeBackupPrivilege	4080	mscalc.EXE
Token: SeRestorePrivilege	4080	mscalc.EXE
Token: SeShutdownPrivilege	4080	mscalc.EXE
Token: SeDebugPrivilege	4080	mscalc.EXE
Token: SeSystemEnvironmentPrivilege	4080	mscalc.EXE
Token: SeChangeNotifyPrivilege	4080	mscalc.EXE
Token: SeRemoteShutdownPrivilege	4080	mscalc.EXE
Token: SeUndockPrivilege	4080	mscalc.EXE
Token: SeManageVolumePrivilege	4080	mscalc.EXE
Token: SeImpersonatePrivilege	4080	mscalc.EXE
Token: SeCreateGlobalPrivilege	4080	mscalc.EXE
Token: 33	4080	mscalc.EXE
Token: 34	4080	mscalc.EXE
Token: 35	4080	mscalc.EXE
Token: 36	4080	mscalc.EXE
Token: SeDebugPrivilege	4072	AMDCPUL.EXE
Token: SeIncreaseQuotaPrivilege	664	svhtiwes.exe
Token: SeSecurityPrivilege	664	svhtiwes.exe
Token: SeTakeOwnershipPrivilege	664	svhtiwes.exe
Token: SeLoadDriverPrivilege	664	svhtiwes.exe
Token: SeSystemProfilePrivilege	664	svhtiwes.exe
Token: SeSystemtimePrivilege	664	svhtiwes.exe
Token: SeProfSingleProcessPrivilege	664	svhtiwes.exe
Token: SeIncBasePriorityPrivilege	664	svhtiwes.exe
Token: SeCreatePagefilePrivilege	664	svhtiwes.exe
Token: SeBackupPrivilege	664	svhtiwes.exe
Token: SeRestorePrivilege	664	svhtiwes.exe
Token: SeShutdownPrivilege	664	svhtiwes.exe
Token: SeDebugPrivilege	664	svhtiwes.exe
Token: SeSystemEnvironmentPrivilege	664	svhtiwes.exe
Token: SeChangeNotifyPrivilege	664	svhtiwes.exe
Token: SeRemoteShutdownPrivilege	664	svhtiwes.exe
Token: SeUndockPrivilege	664	svhtiwes.exe
Token: SeManageVolumePrivilege	664	svhtiwes.exe
Token: SeImpersonatePrivilege	664	svhtiwes.exe
Token: SeCreateGlobalPrivilege	664	svhtiwes.exe
Token: 33	664	svhtiwes.exe
Token: 34	664	svhtiwes.exe
Token: 35	664	svhtiwes.exe
Token: 36	664	svhtiwes.exe
Token: SeRestorePrivilege	4344	WerFault.exe
Token: SeBackupPrivilege	4344	WerFault.exe
Token: SeDebugPrivilege	4344	WerFault.exe
Token: SeDebugPrivilege	1856	MONITRGB.EXE
Token: SeDebugPrivilege	4092	AUDIOMLE.EXE
Token: SeShutdownPrivilege	560	chromes.exe
Token: SeDebugPrivilege	560	chromes.exe
Token: SeTcbPrivilege	560	chromes.exe
Token: SeDebugPrivilege	4808	skype64.exe
Token: SeIncreaseQuotaPrivilege	4856	svhtiwes.exe
Token: SeSecurityPrivilege	4856	svhtiwes.exe
Token: SeTakeOwnershipPrivilege	4856	svhtiwes.exe
Token: SeLoadDriverPrivilege	4856	svhtiwes.exe
Token: SeSystemProfilePrivilege	4856	svhtiwes.exe
Token: SeSystemtimePrivilege	4856	svhtiwes.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

mscalc.exeTVLSWPLE.EXEAcroRd32.exeSERVWINLE.EXEVIDEOGPU.EXEwinskype.exesvhtiwes.exerarl.exesvnhost.exeAcroRd32.exeSERVWINLE.EXETVLSWPLE.EXEVIDEOGPU.EXEwinskype.EXErarl.EXEchromes.exe

pid	process
4764	mscalc.exe
4464	TVLSWPLE.EXE
4044	AcroRd32.exe
4508	SERVWINLE.EXE
4556	VIDEOGPU.EXE
4044	AcroRd32.exe
4044	AcroRd32.exe
4044	AcroRd32.exe
1448	winskype.exe
4044	AcroRd32.exe
4856	svhtiwes.exe
4400	rarl.exe
4156	svnhost.exe
4412	AcroRd32.exe
4852	SERVWINLE.EXE
3464	TVLSWPLE.EXE
4664	VIDEOGPU.EXE
4944	winskype.EXE
4532	rarl.EXE
3272	chromes.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

mscalc.exemscalc.EXEAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4764 wrote to memory of 4080	4764	mscalc.exe	mscalc.EXE
PID 4080 wrote to memory of 4072	4080	mscalc.EXE	AMDCPUL.EXE
PID 4080 wrote to memory of 4072	4080	mscalc.EXE	AMDCPUL.EXE
PID 4080 wrote to memory of 4072	4080	mscalc.EXE	AMDCPUL.EXE
PID 4080 wrote to memory of 4092	4080	mscalc.EXE	AUDIOMLE.EXE
PID 4080 wrote to memory of 4092	4080	mscalc.EXE	AUDIOMLE.EXE
PID 4080 wrote to memory of 4092	4080	mscalc.EXE	AUDIOMLE.EXE
PID 4080 wrote to memory of 4044	4080	mscalc.EXE	AcroRd32.exe
PID 4080 wrote to memory of 4044	4080	mscalc.EXE	AcroRd32.exe
PID 4080 wrote to memory of 4044	4080	mscalc.EXE	AcroRd32.exe
PID 4080 wrote to memory of 1856	4080	mscalc.EXE	MONITRGB.EXE
PID 4080 wrote to memory of 1856	4080	mscalc.EXE	MONITRGB.EXE
PID 4080 wrote to memory of 1856	4080	mscalc.EXE	MONITRGB.EXE
PID 4080 wrote to memory of 4508	4080	mscalc.EXE	SERVWINLE.EXE
PID 4080 wrote to memory of 4508	4080	mscalc.EXE	SERVWINLE.EXE
PID 4080 wrote to memory of 4508	4080	mscalc.EXE	SERVWINLE.EXE
PID 4080 wrote to memory of 4464	4080	mscalc.EXE	TVLSWPLE.EXE
PID 4080 wrote to memory of 4464	4080	mscalc.EXE	TVLSWPLE.EXE
PID 4080 wrote to memory of 4464	4080	mscalc.EXE	TVLSWPLE.EXE
PID 4080 wrote to memory of 4556	4080	mscalc.EXE	VIDEOGPU.EXE
PID 4080 wrote to memory of 4556	4080	mscalc.EXE	VIDEOGPU.EXE
PID 4080 wrote to memory of 4556	4080	mscalc.EXE	VIDEOGPU.EXE
PID 4080 wrote to memory of 4572	4080	mscalc.EXE	WINDRVAMS.EXE
PID 4080 wrote to memory of 4572	4080	mscalc.EXE	WINDRVAMS.EXE
PID 4080 wrote to memory of 4572	4080	mscalc.EXE	WINDRVAMS.EXE
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 384	4080	mscalc.EXE	notepad.exe
PID 4080 wrote to memory of 1448	4080	mscalc.EXE	winskype.exe
PID 4080 wrote to memory of 1448	4080	mscalc.EXE	winskype.exe
PID 4080 wrote to memory of 1448	4080	mscalc.EXE	winskype.exe
PID 4044 wrote to memory of 1676	4044	AcroRd32.exe	RdrCEF.exe
PID 4044 wrote to memory of 1676	4044	AcroRd32.exe	RdrCEF.exe
PID 4044 wrote to memory of 1676	4044	AcroRd32.exe	RdrCEF.exe
PID 1676 wrote to memory of 2576	1676	RdrCEF.exe	RdrCEF.exe
PID 1676 wrote to memory of 2576	1676	RdrCEF.exe	RdrCEF.exe
PID 1676 wrote to memory of 2576	1676	RdrCEF.exe	RdrCEF.exe

C:\Users\Admin\AppData\Local\Temp\mscalc.exe
"C:\Users\Admin\AppData\Local\Temp\mscalc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764

C:\Users\Admin\AppData\Local\Temp\mscalc.EXE
"C:\Users\Admin\AppData\Local\Temp\mscalc.EXE"
2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080

C:\Users\Admin\AppData\Local\Temp\AMDCPUL.EXE
"C:\Users\Admin\AppData\Local\Temp\AMDCPUL.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Users\Admin\AppData\Local\Temp\CLwPnD6Wc4q5GVo4\svhtiwes.exe
"C:\Users\Admin\AppData\Local\Temp\CLwPnD6Wc4q5GVo4\svhtiwes.exe"
4⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:1380

C:\Users\Admin\Documents\skype64.exe
"C:\Users\Admin\Documents\skype64.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Users\Admin\AppData\Local\Temp\CLwPnD6Wc4q5GVo4\svhtiwes.exe
"C:\Users\Admin\AppData\Local\Temp\CLwPnD6Wc4q5GVo4\svhtiwes.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\SysWOW64\notepad.exe
notepad
7⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1068
6⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1076
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Users\Admin\AppData\Local\Temp\AUDIOMLE.EXE
"C:\Users\Admin\AppData\Local\Temp\AUDIOMLE.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'amdvideol"' /tr "'C:\Users\Admin\AppData\Roaming\amdvideol.exe"'
4⤵
- Creates scheduled task(s)
PID:876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp977E.tmp.bat""
4⤵
PID:4492

C:\Windows\SysWOW64\timeout.exe
timeout 3
5⤵
- Delays execution with timeout.exe
PID:5068

C:\Users\Admin\AppData\Roaming\amdvideol.exe
"C:\Users\Admin\AppData\Roaming\amdvideol.exe"
5⤵
- Executes dropped EXE
PID:4128

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.PDF"
3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
4⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E155A557E6A5EFC291614F3E70F38C80 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E155A557E6A5EFC291614F3E70F38C80 --renderer-client-id=2 --mojo-platform-channel-handle=1588 --allow-no-sandbox-job /prefetch:1
5⤵
PID:2576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=453B67A22A301368E4D082B666B112A9 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
5⤵
PID:2856

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E6C16D2CC005B3EDCF57D78E381DEC6 --mojo-platform-channel-handle=2200 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
5⤵
PID:4596

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F08748016BE08F0DB0BD91472233A0A4 --mojo-platform-channel-handle=1928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
5⤵
PID:5088

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9256883A0CC1E010F2A4353433937F2D --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
5⤵
PID:60

C:\Users\Admin\AppData\Local\Temp\MONITRGB.EXE
"C:\Users\Admin\AppData\Local\Temp\MONITRGB.EXE"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
4⤵
- Executes dropped EXE
PID:4256

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
4⤵
- Executes dropped EXE
PID:4284

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe" 560
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4180

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
6⤵
- Executes dropped EXE
PID:1896

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe" 1896
7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1184

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
8⤵
- Executes dropped EXE
PID:3144

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
8⤵
- Executes dropped EXE
PID:204

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
8⤵
- Executes dropped EXE
PID:2500

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
8⤵
- Executes dropped EXE
PID:216

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
4⤵
- Executes dropped EXE
PID:2644

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
4⤵
- Executes dropped EXE
PID:4268

C:\Users\Admin\AppData\Local\Temp\SERVWINLE.EXE
"C:\Users\Admin\AppData\Local\Temp\SERVWINLE.EXE"
3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4508

C:\Users\Admin\AppData\Local\Temp\SERVWINLE.EXE
"C:\Users\Admin\AppData\Local\Temp\SERVWINLE.EXE"
4⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
PID:196

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:3104

C:\Users\Admin\Documents\rarl.exe
"C:\Users\Admin\Documents\rarl.exe"
5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Users\Admin\Documents\rarl.EXE
"C:\Users\Admin\Documents\rarl.EXE"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Windows\SysWOW64\notepad.exe
notepad
7⤵
PID:4152

C:\Users\Admin\AppData\Local\Temp\TVLSWPLE.EXE
"C:\Users\Admin\AppData\Local\Temp\TVLSWPLE.EXE"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4464

C:\Users\Admin\AppData\Local\Temp\TVLSWPLE.EXE
"C:\Users\Admin\AppData\Local\Temp\TVLSWPLE.EXE"
4⤵
- Executes dropped EXE
PID:2888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
5⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\VIDEOGPU.EXE
"C:\Users\Admin\AppData\Local\Temp\VIDEOGPU.EXE"
3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Users\Admin\AppData\Local\Temp\VIDEOGPU.EXE
"C:\Users\Admin\AppData\Local\Temp\VIDEOGPU.EXE"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3952

C:\ProgramData\svnhost.exe
"C:\ProgramData\svnhost.exe"
5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4156

C:\ProgramData\svnhost.EXE
"C:\ProgramData\svnhost.EXE"
6⤵
- Executes dropped EXE
PID:4360

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
7⤵
PID:3916

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
- Deletes itself
PID:384

C:\Users\Admin\AppData\Local\Temp\WINDRVAMS.EXE
"C:\Users\Admin\AppData\Local\Temp\WINDRVAMS.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4572

C:\Users\Admin\AppData\Local\Temp\3I4SeOI5PFPCXXYo\winsers.exe
"C:\Users\Admin\AppData\Local\Temp\3I4SeOI5PFPCXXYo\winsers.exe"
4⤵
- Executes dropped EXE
PID:592

C:\Users\Admin\AppData\Local\Temp\3I4SeOI5PFPCXXYo\winsers.exe
"C:\Users\Admin\AppData\Local\Temp\3I4SeOI5PFPCXXYo\winsers.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4660

C:\ProgramData\imagles.exe
"C:\ProgramData\imagles.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2364

C:\Users\Admin\AppData\Local\Temp\3I4SeOI5PFPCXXYo\winsers.exe
"C:\Users\Admin\AppData\Local\Temp\3I4SeOI5PFPCXXYo\winsers.exe"
6⤵
- Executes dropped EXE
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1084
4⤵
- Program crash
PID:4052

C:\Users\Admin\Documents\winskype.exe
"C:\Users\Admin\Documents\winskype.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1448

C:\Users\Admin\Documents\winskype.EXE
"C:\Users\Admin\Documents\winskype.EXE"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4944

C:\Users\Admin\AppData\Local\Temp\AMDCPUL.EXE
"C:\Users\Admin\AppData\Local\Temp\AMDCPUL.EXE"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3256

C:\Users\Admin\AppData\Local\Temp\CLwPnD6Wc4q5GVo4\svhtiwes.exe
"C:\Users\Admin\AppData\Local\Temp\CLwPnD6Wc4q5GVo4\svhtiwes.exe"
6⤵
- Executes dropped EXE
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1004
6⤵
- Program crash
PID:4676

C:\Users\Admin\AppData\Local\Temp\AUDIOMLE.EXE
"C:\Users\Admin\AppData\Local\Temp\AUDIOMLE.EXE"
5⤵
- Executes dropped EXE
PID:4796

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'amdvideol"' /tr "'C:\Users\Admin\AppData\Roaming\amdvideol.exe"'
6⤵
- Creates scheduled task(s)
PID:4480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1CEA.tmp.bat""
6⤵
PID:496

C:\Windows\SysWOW64\timeout.exe
timeout 3
7⤵
- Delays execution with timeout.exe
PID:3004

C:\Users\Admin\AppData\Roaming\amdvideol.exe
"C:\Users\Admin\AppData\Roaming\amdvideol.exe"
7⤵
- Executes dropped EXE
PID:2220

C:\Users\Admin\AppData\Local\Temp\MONITRGB.EXE
"C:\Users\Admin\AppData\Local\Temp\MONITRGB.EXE"
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3924

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
6⤵
- Executes dropped EXE
PID:192

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe" 192
7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3900

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3272

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe" 3272
9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4436

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
10⤵
- Executes dropped EXE
PID:4848

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DOCUMENT.PDF"
5⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4412

C:\Users\Admin\AppData\Local\Temp\SERVWINLE.EXE
"C:\Users\Admin\AppData\Local\Temp\SERVWINLE.EXE"
5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4852

C:\Users\Admin\AppData\Local\Temp\SERVWINLE.EXE
"C:\Users\Admin\AppData\Local\Temp\SERVWINLE.EXE"
6⤵
- Executes dropped EXE
PID:3372

C:\Users\Admin\AppData\Local\Temp\TVLSWPLE.EXE
"C:\Users\Admin\AppData\Local\Temp\TVLSWPLE.EXE"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3464

C:\Users\Admin\AppData\Local\Temp\TVLSWPLE.EXE
"C:\Users\Admin\AppData\Local\Temp\TVLSWPLE.EXE"
6⤵
- Executes dropped EXE
PID:1548

C:\Users\Admin\AppData\Local\Temp\WINDRVAMS.EXE
"C:\Users\Admin\AppData\Local\Temp\WINDRVAMS.EXE"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4076

C:\Users\Admin\AppData\Local\Temp\3I4SeOI5PFPCXXYo\winsers.exe
"C:\Users\Admin\AppData\Local\Temp\3I4SeOI5PFPCXXYo\winsers.exe"
6⤵
- Executes dropped EXE
PID:4340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
7⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 1012
6⤵
- Program crash
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 980
6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5108

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:5084

C:\Users\Admin\AppData\Local\Temp\VIDEOGPU.EXE
"C:\Users\Admin\AppData\Local\Temp\VIDEOGPU.EXE"
5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4664

C:\Users\Admin\AppData\Local\Temp\VIDEOGPU.EXE
"C:\Users\Admin\AppData\Local\Temp\VIDEOGPU.EXE"
6⤵
- Executes dropped EXE
PID:4356

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe" 2500
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4348

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
2⤵
- Executes dropped EXE
PID:3032

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe" 3032
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:968

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
4⤵
- Executes dropped EXE
PID:2904

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
4⤵
- Executes dropped EXE
PID:604

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe" 604
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1668

C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe
"C:\Users\Admin\AppData\Local\Temp\z2KQhhNiHkHL54H6\chromes.exe"
6⤵
- Executes dropped EXE
PID:4244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery