cryptbot | e99107f51a615207824a28411b0355fba67cbda8dbd24d450a84cbe40aa8faf5

Processes:

PlayerUI6.exeRhcudGhKYLxKQE6zcvuIUBMy.exepzysgf.exe215965.2

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Muavi Music Player AElxXIznF3Mu4cyDv1lC 3QAtTU_uwgcGNqj = "C:\\Users\\Admin\\AppData\\Roaming\\MicrosoftgnsroFMbcalxhPwiMc8UZDgfUpdater.exe"	PlayerUI6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\gRpW1Q5mTJDnq1O001K8axQJEcREJt4q = "C:\\Users\\Admin\\Documents\\bULSMj4veCPSxN025PeCmuwX.exe"	RhcudGhKYLxKQE6zcvuIUBMy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\4lm1SQ1z9LRYjd7zk57fEIM9JFLd4bRg = "C:\\Users\\Admin\\Documents\\VoA8omWHaUucnTw3SHqW8y74.exe"	PlayerUI6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\DGBSMkHRpKs7bh0CtaytYhUQptlb3jDX = "C:\\Users\\Admin\\Documents\\guBti5TOeth1Uuz4M2dctJe4.exe"	PlayerUI6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ueb5xQvcZxbmCjcmc7CX0zkzT58ekkyQ = "C:\\Users\\Admin\\Documents\\RhcudGhKYLxKQE6zcvuIUBMy.exe"	PlayerUI6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\FNF3HCRyOyneWGFE9B6loSKdiFuFTAii = "C:\\Users\\Admin\\Documents\\Ro6Nb9bsOQxgTB8F5zKp6s1E.exe"	RhcudGhKYLxKQE6zcvuIUBMy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\zcwDx0Ycor7PscRZ8DoTd5YpBfnxUWCw = "C:\\Users\\Admin\\Documents\\K9t0MU9HE2MLiRAiWdScfXc8.exe"	PlayerUI6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	pzysgf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\FFKzBD0nfDqeFhwcroRvFViPHbnj5Suv = "C:\\Users\\Admin\\Documents\\JoJdiS9l41i8KHHCoLsE4Xc9.exe"	RhcudGhKYLxKQE6zcvuIUBMy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\o6asF10pFdPHPbTdu7KtLqG76CDARmzi = "C:\\Users\\Admin\\Documents\\ZmsMFY5h3useZ3zFGyCJpu7w.exe"	PlayerUI6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ClVBRMeOQFqf81KbaunpApFDW5VNTnvh = "C:\\Users\\Admin\\Documents\\x1IN4ilM89RfXesyuGq4wQax.exe"	RhcudGhKYLxKQE6zcvuIUBMy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\wWSDqOpOORoXwmDE95iRpyZQAp7CZqHo = "C:\\Users\\Admin\\Documents\\qFEDAfzJd4dcCXTzK0vD1b0w.exe"	PlayerUI6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe"	215965.2
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\nZzhDfWlR1s0IPBVvqPMmoUtXOeSunWp = "C:\\Users\\Admin\\Documents\\ztsx3X0CHRcz038QSqhduKkE.exe"	RhcudGhKYLxKQE6zcvuIUBMy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\g4sjZRrNT4S5ITUhEauK2cyeegKp5epe = "C:\\Users\\Admin\\Documents\\LKYdIJj1A5dGbm6HYPXPGr3t.exe"	RhcudGhKYLxKQE6zcvuIUBMy.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com
117 api.ipify.org

flow	ioc
8	ip-api.com
117	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Scorso.exe.com

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Scorso.exe.com
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Scorso.exe.com

Suspicious use of SetThreadContext 5 IoCs

Processes:

ztsx3X0CHRcz038QSqhduKkE.exex1IN4ilM89RfXesyuGq4wQax.exe07534866862.exe69898409284.exeScorso.exe.com

description	pid	process	target process
PID 2464 set thread context of 2796	2464	ztsx3X0CHRcz038QSqhduKkE.exe	ztsx3X0CHRcz038QSqhduKkE.exe
PID 736 set thread context of 1972	736	x1IN4ilM89RfXesyuGq4wQax.exe	x1IN4ilM89RfXesyuGq4wQax.exe
PID 2320 set thread context of 1240	2320	07534866862.exe	AddInProcess32.exe
PID 2516 set thread context of 2756	2516	69898409284.exe	AddInProcess32.exe
PID 1184 set thread context of 2092	1184	Scorso.exe.com	Scorso.exe.com

Drops file in Windows directory 2 IoCs

Processes:

multitimer.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2652 2808 WerFault.exe Scorso.exe.com

pid	pid_target	process	target process
2652	2808	WerFault.exe	Scorso.exe.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

pub2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

33473834218.exe09115031845.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	33473834218.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	09115031845.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	09115031845.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	33473834218.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

1088 taskkill.exe
2848 taskkill.exe
2456 taskkill.exe
2132 taskkill.exe

pid	process
1088	taskkill.exe
2848	taskkill.exe
2456	taskkill.exe
2132	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70dbc5f78420d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fcf53ca0f9b57547955d7761585a473b00000000020000000000106600000001000020000000124be29a15cc78d47c814b653b46114a57973ec8c4862a00e962b64db0bc8799000000000e8000000002000020000000c665fe235b1dc289fed6f8a75790b1e8a09fc1f21535bec5e2dd88462c12bec590000000788a6ece8e402b738ece4798f8a7f3ee885a04a495d31cc4c724eccae4eac0fed4c04ec8828fb49ade9d1aba22910fbde9f4d6a07a6e16d2d496c2649eea1681d7885fb50f1a30ecdefe490cd5000715710500103afb0a35f8b2ecbfdc20f1d9a6d113cb501a9d9e761d7c2ea2ae6e0db07a24181900029dfe1c450804ce97d265e8f86f7d534471e5bcc8652242d1ef40000000df1a481a2747d83067202d78728f0b901d9e8778c6d92a753ae101a091620f30fdbb3176fe9537d90a578f9413f3bb3f88fb09c6d00a3aa9c13be2a77b997609	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12224EB1-8C78-11EB-9AD1-4AAA7B04F187} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fcf53ca0f9b57547955d7761585a473b0000000002000000000010660000000100002000000046d97abdd8adfb0f086035e517d842390ba9bcd0495531db7b5773909e6ad986000000000e8000000002000020000000831014a1d38cc0173363f154bf4ac8caf0f16ef7ed877b9e2329813b9d744a3e20000000901ea7fc6d82b752c98aa23537deea31896ec61d6c914857a89f372cefee7dd5400000004671423aa1e2b26a20f86be026a9d1dddfe2e995354570166c52ef61125ed2c3ad5af61bc55e3f1aa864e2b78123d9ae5a6205a7a23ff9defbc736789fa6729d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "323338284"	iexplore.exe

Modifies registry class 20 IoCs

Processes:

42381.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	42381.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	42381.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	42381.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	42381.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	42381.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_Classes\Local Settings	42381.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	42381.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	42381.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	42381.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	42381.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	42381.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	42381.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	42381.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	42381.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	42381.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	42381.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	42381.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	42381.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	42381.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	42381.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

KRSetp.exe7718157.84mmt.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	KRSetp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	7718157.84
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	mmt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	KRSetp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	KRSetp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	7718157.84
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	7718157.84
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	mmt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	KRSetp.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

1388 PING.EXE
2292 PING.EXE
3032 PING.EXE

pid	process
1388	PING.EXE
2292	PING.EXE
3032	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pub2.exesetups.tmp

pid	process
1664	pub2.exe
1664	pub2.exe
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1276	setups.tmp
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

guBti5TOeth1Uuz4M2dctJe4.exeZmsMFY5h3useZ3zFGyCJpu7w.exe

pid	process
2624	guBti5TOeth1Uuz4M2dctJe4.exe
2624	guBti5TOeth1Uuz4M2dctJe4.exe
2624	guBti5TOeth1Uuz4M2dctJe4.exe
2028	ZmsMFY5h3useZ3zFGyCJpu7w.exe
2028	ZmsMFY5h3useZ3zFGyCJpu7w.exe
2028	ZmsMFY5h3useZ3zFGyCJpu7w.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pub2.exe

pid process

1664 pub2.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

aszd.exemmt.exetaskkill.exeKRSetp.exePlayerUI6.exe8956744.98RhcudGhKYLxKQE6zcvuIUBMy.exe7718157.84md9_9sjm.exeK9t0MU9HE2MLiRAiWdScfXc8.exe07534866862.exe69898409284.exetaskkill.exetaskkill.exeguBti5TOeth1Uuz4M2dctJe4.exeZmsMFY5h3useZ3zFGyCJpu7w.exeAddInProcess32.exeAddInProcess32.exeWerFault.exe

description	pid	process
Token: SeCreateTokenPrivilege	2044	aszd.exe
Token: SeAssignPrimaryTokenPrivilege	2044	aszd.exe
Token: SeLockMemoryPrivilege	2044	aszd.exe
Token: SeIncreaseQuotaPrivilege	2044	aszd.exe
Token: SeMachineAccountPrivilege	2044	aszd.exe
Token: SeTcbPrivilege	2044	aszd.exe
Token: SeSecurityPrivilege	2044	aszd.exe
Token: SeTakeOwnershipPrivilege	2044	aszd.exe
Token: SeLoadDriverPrivilege	2044	aszd.exe
Token: SeSystemProfilePrivilege	2044	aszd.exe
Token: SeSystemtimePrivilege	2044	aszd.exe
Token: SeProfSingleProcessPrivilege	2044	aszd.exe
Token: SeIncBasePriorityPrivilege	2044	aszd.exe
Token: SeCreatePagefilePrivilege	2044	aszd.exe
Token: SeCreatePermanentPrivilege	2044	aszd.exe
Token: SeBackupPrivilege	2044	aszd.exe
Token: SeRestorePrivilege	2044	aszd.exe
Token: SeShutdownPrivilege	2044	aszd.exe
Token: SeDebugPrivilege	2044	aszd.exe
Token: SeAuditPrivilege	2044	aszd.exe
Token: SeSystemEnvironmentPrivilege	2044	aszd.exe
Token: SeChangeNotifyPrivilege	2044	aszd.exe
Token: SeRemoteShutdownPrivilege	2044	aszd.exe
Token: SeUndockPrivilege	2044	aszd.exe
Token: SeSyncAgentPrivilege	2044	aszd.exe
Token: SeEnableDelegationPrivilege	2044	aszd.exe
Token: SeManageVolumePrivilege	2044	aszd.exe
Token: SeImpersonatePrivilege	2044	aszd.exe
Token: SeCreateGlobalPrivilege	2044	aszd.exe
Token: 31	2044	aszd.exe
Token: 32	2044	aszd.exe
Token: 33	2044	aszd.exe
Token: 34	2044	aszd.exe
Token: 35	2044	aszd.exe
Token: SeDebugPrivilege	292	mmt.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	1752	KRSetp.exe
Token: SeDebugPrivilege	1536	PlayerUI6.exe
Token: SeShutdownPrivilege	1356
Token: SeDebugPrivilege	336	8956744.98
Token: SeDebugPrivilege	2076	RhcudGhKYLxKQE6zcvuIUBMy.exe
Token: SeDebugPrivilege	1672	7718157.84
Token: SeManageVolumePrivilege	1924	md9_9sjm.exe
Token: SeShutdownPrivilege	1356
Token: SeDebugPrivilege	2848	K9t0MU9HE2MLiRAiWdScfXc8.exe
Token: SeShutdownPrivilege	1356
Token: SeShutdownPrivilege	1356
Token: SeShutdownPrivilege	1356
Token: SeDebugPrivilege	2320	07534866862.exe
Token: SeDebugPrivilege	2516	69898409284.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	2456	taskkill.exe
Token: SeLoadDriverPrivilege	2624	guBti5TOeth1Uuz4M2dctJe4.exe
Token: SeLoadDriverPrivilege	2624	guBti5TOeth1Uuz4M2dctJe4.exe
Token: SeLoadDriverPrivilege	2624	guBti5TOeth1Uuz4M2dctJe4.exe
Token: SeLoadDriverPrivilege	2028	ZmsMFY5h3useZ3zFGyCJpu7w.exe
Token: SeLoadDriverPrivilege	2028	ZmsMFY5h3useZ3zFGyCJpu7w.exe
Token: SeLoadDriverPrivilege	2028	ZmsMFY5h3useZ3zFGyCJpu7w.exe
Token: SeDebugPrivilege	1240	AddInProcess32.exe
Token: SeDebugPrivilege	2756	AddInProcess32.exe
Token: SeShutdownPrivilege	1356
Token: SeDebugPrivilege	2652	WerFault.exe
Token: SeShutdownPrivilege	1356

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

iexplore.exe

pid process

1356
1356
1616 iexplore.exe
1356
1356
1356
1356
1356
1356
Suspicious use of SendNotifyMessage 15 IoCs

Processes:

pid process

1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

iexplore.exeIEXPLORE.EXE42381.exe

pid process

1616 iexplore.exe
1616 iexplore.exe
2712 IEXPLORE.EXE
2712 IEXPLORE.EXE
2472 42381.exe

pid	process
1356
1356
1616	iexplore.exe
1356
1356
1356
1356
1356
1356

pid	process
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356
1356

pid	process
1616	iexplore.exe
1616	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2472	42381.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

78260204AB2A8D1039EA744D228CED1F.execllhjkd.exepzysgf.execmd.exeKRSetp.exe

description	pid	process	target process
PID 1084 wrote to memory of 2044	1084	78260204AB2A8D1039EA744D228CED1F.exe	aszd.exe
PID 1084 wrote to memory of 2044	1084	78260204AB2A8D1039EA744D228CED1F.exe	aszd.exe
PID 1084 wrote to memory of 2044	1084	78260204AB2A8D1039EA744D228CED1F.exe	aszd.exe
PID 1084 wrote to memory of 2044	1084	78260204AB2A8D1039EA744D228CED1F.exe	aszd.exe
PID 1084 wrote to memory of 1924	1084	78260204AB2A8D1039EA744D228CED1F.exe	md9_9sjm.exe
PID 1084 wrote to memory of 1924	1084	78260204AB2A8D1039EA744D228CED1F.exe	md9_9sjm.exe
PID 1084 wrote to memory of 1924	1084	78260204AB2A8D1039EA744D228CED1F.exe	md9_9sjm.exe
PID 1084 wrote to memory of 1924	1084	78260204AB2A8D1039EA744D228CED1F.exe	md9_9sjm.exe
PID 1084 wrote to memory of 1752	1084	78260204AB2A8D1039EA744D228CED1F.exe	KRSetp.exe
PID 1084 wrote to memory of 1752	1084	78260204AB2A8D1039EA744D228CED1F.exe	KRSetp.exe
PID 1084 wrote to memory of 1752	1084	78260204AB2A8D1039EA744D228CED1F.exe	KRSetp.exe
PID 1084 wrote to memory of 1752	1084	78260204AB2A8D1039EA744D228CED1F.exe	KRSetp.exe
PID 1084 wrote to memory of 1720	1084	78260204AB2A8D1039EA744D228CED1F.exe	cllhjkd.exe
PID 1084 wrote to memory of 1720	1084	78260204AB2A8D1039EA744D228CED1F.exe	cllhjkd.exe
PID 1084 wrote to memory of 1720	1084	78260204AB2A8D1039EA744D228CED1F.exe	cllhjkd.exe
PID 1084 wrote to memory of 1720	1084	78260204AB2A8D1039EA744D228CED1F.exe	cllhjkd.exe
PID 1084 wrote to memory of 1720	1084	78260204AB2A8D1039EA744D228CED1F.exe	cllhjkd.exe
PID 1084 wrote to memory of 1720	1084	78260204AB2A8D1039EA744D228CED1F.exe	cllhjkd.exe
PID 1084 wrote to memory of 1720	1084	78260204AB2A8D1039EA744D228CED1F.exe	cllhjkd.exe
PID 1084 wrote to memory of 1536	1084	78260204AB2A8D1039EA744D228CED1F.exe	PlayerUI6.exe
PID 1084 wrote to memory of 1536	1084	78260204AB2A8D1039EA744D228CED1F.exe	PlayerUI6.exe
PID 1084 wrote to memory of 1536	1084	78260204AB2A8D1039EA744D228CED1F.exe	PlayerUI6.exe
PID 1084 wrote to memory of 1536	1084	78260204AB2A8D1039EA744D228CED1F.exe	PlayerUI6.exe
PID 1084 wrote to memory of 1664	1084	78260204AB2A8D1039EA744D228CED1F.exe	pub2.exe
PID 1084 wrote to memory of 1664	1084	78260204AB2A8D1039EA744D228CED1F.exe	pub2.exe
PID 1084 wrote to memory of 1664	1084	78260204AB2A8D1039EA744D228CED1F.exe	pub2.exe
PID 1084 wrote to memory of 1664	1084	78260204AB2A8D1039EA744D228CED1F.exe	pub2.exe
PID 1084 wrote to memory of 1528	1084	78260204AB2A8D1039EA744D228CED1F.exe	pzysgf.exe
PID 1084 wrote to memory of 1528	1084	78260204AB2A8D1039EA744D228CED1F.exe	pzysgf.exe
PID 1084 wrote to memory of 1528	1084	78260204AB2A8D1039EA744D228CED1F.exe	pzysgf.exe
PID 1084 wrote to memory of 1528	1084	78260204AB2A8D1039EA744D228CED1F.exe	pzysgf.exe
PID 1084 wrote to memory of 292	1084	78260204AB2A8D1039EA744D228CED1F.exe	mmt.exe
PID 1084 wrote to memory of 292	1084	78260204AB2A8D1039EA744D228CED1F.exe	mmt.exe
PID 1084 wrote to memory of 292	1084	78260204AB2A8D1039EA744D228CED1F.exe	mmt.exe
PID 1084 wrote to memory of 292	1084	78260204AB2A8D1039EA744D228CED1F.exe	mmt.exe
PID 1720 wrote to memory of 1072	1720	cllhjkd.exe	cmd.exe
PID 1720 wrote to memory of 1072	1720	cllhjkd.exe	cmd.exe
PID 1720 wrote to memory of 1072	1720	cllhjkd.exe	cmd.exe
PID 1720 wrote to memory of 1072	1720	cllhjkd.exe	cmd.exe
PID 1720 wrote to memory of 1072	1720	cllhjkd.exe	cmd.exe
PID 1720 wrote to memory of 1072	1720	cllhjkd.exe	cmd.exe
PID 1720 wrote to memory of 1072	1720	cllhjkd.exe	cmd.exe
PID 1528 wrote to memory of 1196	1528	pzysgf.exe	jfiag3g_gg.exe
PID 1528 wrote to memory of 1196	1528	pzysgf.exe	jfiag3g_gg.exe
PID 1528 wrote to memory of 1196	1528	pzysgf.exe	jfiag3g_gg.exe
PID 1528 wrote to memory of 1196	1528	pzysgf.exe	jfiag3g_gg.exe
PID 1072 wrote to memory of 1484	1072	cmd.exe	ySerjRi2.exe
PID 1072 wrote to memory of 1484	1072	cmd.exe	ySerjRi2.exe
PID 1072 wrote to memory of 1484	1072	cmd.exe	ySerjRi2.exe
PID 1072 wrote to memory of 1484	1072	cmd.exe	ySerjRi2.exe
PID 1072 wrote to memory of 1484	1072	cmd.exe	ySerjRi2.exe
PID 1072 wrote to memory of 1484	1072	cmd.exe	ySerjRi2.exe
PID 1072 wrote to memory of 1484	1072	cmd.exe	ySerjRi2.exe
PID 1072 wrote to memory of 1088	1072	cmd.exe	taskkill.exe
PID 1072 wrote to memory of 1088	1072	cmd.exe	taskkill.exe
PID 1072 wrote to memory of 1088	1072	cmd.exe	taskkill.exe
PID 1072 wrote to memory of 1088	1072	cmd.exe	taskkill.exe
PID 1072 wrote to memory of 1088	1072	cmd.exe	taskkill.exe
PID 1072 wrote to memory of 1088	1072	cmd.exe	taskkill.exe
PID 1072 wrote to memory of 1088	1072	cmd.exe	taskkill.exe
PID 1752 wrote to memory of 336	1752	KRSetp.exe	8956744.98
PID 1752 wrote to memory of 336	1752	KRSetp.exe	8956744.98
PID 1752 wrote to memory of 336	1752	KRSetp.exe	8956744.98
PID 1752 wrote to memory of 336	1752	KRSetp.exe	8956744.98

C:\Users\Admin\AppData\Local\Temp\78260204AB2A8D1039EA744D228CED1F.exe
"C:\Users\Admin\AppData\Local\Temp\78260204AB2A8D1039EA744D228CED1F.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084

C:\Users\Admin\AppData\Local\Temp\aszd.exe
"C:\Users\Admin\AppData\Local\Temp\aszd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
PID:2792

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
4⤵
- Kills process with taskkill
PID:2848

C:\Users\Admin\AppData\Local\Temp\md9_9sjm.exe
"C:\Users\Admin\AppData\Local\Temp\md9_9sjm.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

C:\ProgramData\8956744.98
"C:\ProgramData\8956744.98"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:336

C:\ProgramData\215965.2
"C:\ProgramData\215965.2"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1504

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
4⤵
- Executes dropped EXE
PID:2084

C:\ProgramData\7718157.84
"C:\ProgramData\7718157.84"
3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Users\Admin\AppData\Local\Temp\cllhjkd.exe
"C:\Users\Admin\AppData\Local\Temp\cllhjkd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\cllhjkd.exe" ySerjRi2.exe> NuL&&sTaRT ySerjRi2.exe -PDCM9U3PjEKIfJ & If "" =="" for %N In ("C:\Users\Admin\AppData\Local\Temp\cllhjkd.exe" ) do taskkill -f /IM "%~NXN" > Nul
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\taskkill.exe
taskkill -f /IM "cllhjkd.exe"
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Users\Admin\AppData\Local\Temp\ySerjRi2.exe
ySerjRi2.exe -PDCM9U3PjEKIfJ
4⤵
- Executes dropped EXE
PID:1484

C:\Users\Admin\AppData\Local\Temp\PlayerUI6.exe
"C:\Users\Admin\AppData\Local\Temp\PlayerUI6.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Users\Admin\Documents\RhcudGhKYLxKQE6zcvuIUBMy.exe
"C:\Users\Admin\Documents\RhcudGhKYLxKQE6zcvuIUBMy.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2076

C:\Users\Admin\Documents\LKYdIJj1A5dGbm6HYPXPGr3t.exe
"C:\Users\Admin\Documents\LKYdIJj1A5dGbm6HYPXPGr3t.exe"
4⤵
- Executes dropped EXE
PID:2192

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{4tzk-v8HCS-rcZ7-YA7jI}\69898409284.exe"
5⤵
- Loads dropped DLL
PID:516

C:\Users\Admin\AppData\Local\Temp\{4tzk-v8HCS-rcZ7-YA7jI}\69898409284.exe
"C:\Users\Admin\AppData\Local\Temp\{4tzk-v8HCS-rcZ7-YA7jI}\69898409284.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
PID:2292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
PID:2036

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
PID:2892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
PID:1368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{4tzk-v8HCS-rcZ7-YA7jI}\09115031845.exe" /mix
5⤵
- Loads dropped DLL
PID:1756

C:\Users\Admin\AppData\Local\Temp\{4tzk-v8HCS-rcZ7-YA7jI}\09115031845.exe
"C:\Users\Admin\AppData\Local\Temp\{4tzk-v8HCS-rcZ7-YA7jI}\09115031845.exe" /mix
6⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "LKYdIJj1A5dGbm6HYPXPGr3t.exe" /f & erase "C:\Users\Admin\Documents\LKYdIJj1A5dGbm6HYPXPGr3t.exe" & exit
5⤵
PID:2844

C:\Users\Admin\Documents\ztsx3X0CHRcz038QSqhduKkE.exe
"C:\Users\Admin\Documents\ztsx3X0CHRcz038QSqhduKkE.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2464

C:\Users\Admin\Documents\ztsx3X0CHRcz038QSqhduKkE.exe
"C:\Users\Admin\Documents\ztsx3X0CHRcz038QSqhduKkE.exe"
5⤵
- Executes dropped EXE
PID:2796

C:\Users\Admin\Documents\JoJdiS9l41i8KHHCoLsE4Xc9.exe
"C:\Users\Admin\Documents\JoJdiS9l41i8KHHCoLsE4Xc9.exe"
4⤵
- Executes dropped EXE
PID:2140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c echo yLBUjKkTN
5⤵
PID:2964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Infervora.aac
5⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
6⤵
PID:2868

C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com
Scorso.exe.com c
7⤵
- Executes dropped EXE
PID:1588

C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com
C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com c
8⤵
- Executes dropped EXE
PID:2808

C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com
C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com
9⤵
- Executes dropped EXE
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 504
9⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
7⤵
- Runs ping.exe
PID:1388

C:\Users\Admin\Documents\Ro6Nb9bsOQxgTB8F5zKp6s1E.exe
"C:\Users\Admin\Documents\Ro6Nb9bsOQxgTB8F5zKp6s1E.exe"
4⤵
- Executes dropped EXE
PID:2040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{TIga-HI1rF-1Gie-aMeAP}\07534866862.exe"
5⤵
- Loads dropped DLL
PID:2836

C:\Users\Admin\AppData\Local\Temp\{TIga-HI1rF-1Gie-aMeAP}\07534866862.exe
"C:\Users\Admin\AppData\Local\Temp\{TIga-HI1rF-1Gie-aMeAP}\07534866862.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Ro6Nb9bsOQxgTB8F5zKp6s1E.exe" /f & erase "C:\Users\Admin\Documents\Ro6Nb9bsOQxgTB8F5zKp6s1E.exe" & exit
5⤵
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Ro6Nb9bsOQxgTB8F5zKp6s1E.exe" /f
6⤵
- Executes dropped EXE
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{TIga-HI1rF-1Gie-aMeAP}\33473834218.exe" /mix
5⤵
- Loads dropped DLL
PID:3052

C:\Users\Admin\Documents\x1IN4ilM89RfXesyuGq4wQax.exe
"C:\Users\Admin\Documents\x1IN4ilM89RfXesyuGq4wQax.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:736

C:\Users\Admin\Documents\x1IN4ilM89RfXesyuGq4wQax.exe
"C:\Users\Admin\Documents\x1IN4ilM89RfXesyuGq4wQax.exe"
5⤵
- Executes dropped EXE
PID:1972

C:\Users\Admin\Documents\bULSMj4veCPSxN025PeCmuwX.exe
"C:\Users\Admin\Documents\bULSMj4veCPSxN025PeCmuwX.exe"
4⤵
- Executes dropped EXE
PID:740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c echo yLBUjKkTN
5⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe < Infervora.aac
5⤵
PID:2924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe
6⤵
- Loads dropped DLL
PID:2608

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^CqhAYgTvATlPdcvCeYviHwPmfncbDHATHrSjQXXQMoqHcgpelcLwzOfAlNlASvSSasohCpMyqGcnworqfzhiWmASNserNbXdfigtuVmqJFwMzQmeJpkmpLVTRfAkiIsDItpTTZUzUjndbNmWSq$" Rivedervi.psd
7⤵
PID:2844

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "LKYdIJj1A5dGbm6HYPXPGr3t.exe" /f
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com
Scorso.exe.com c
7⤵
PID:3024

C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com
C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com c
8⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
PID:1184

C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com
C:\Users\Admin\AppData\Roaming\wVDJwIWFIeypECF\Scorso.exe.com
9⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Maps connected drives based on registry
PID:2092

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\42381.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\42381.exe"
10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2472

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Roaming\del.bat
10⤵
PID:2928

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 3
11⤵
- Runs ping.exe
PID:2292

C:\Windows\SysWOW64\cmd.exe
cmd /c del "C:\Users\Admin\AppData\Roaming\del.bat"
11⤵
PID:1368

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
7⤵
- Runs ping.exe
PID:3032

C:\Users\Admin\Documents\VoA8omWHaUucnTw3SHqW8y74.exe
"C:\Users\Admin\Documents\VoA8omWHaUucnTw3SHqW8y74.exe"
3⤵
- Executes dropped EXE
PID:2964

C:\Users\Admin\Documents\K9t0MU9HE2MLiRAiWdScfXc8.exe
"C:\Users\Admin\Documents\K9t0MU9HE2MLiRAiWdScfXc8.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Users\Admin\Documents\ZmsMFY5h3useZ3zFGyCJpu7w.exe
"C:\Users\Admin\Documents\ZmsMFY5h3useZ3zFGyCJpu7w.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Users\Admin\Documents\guBti5TOeth1Uuz4M2dctJe4.exe
"C:\Users\Admin\Documents\guBti5TOeth1Uuz4M2dctJe4.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Users\Admin\AppData\Local\Temp\pub2.exe
"C:\Users\Admin\AppData\Local\Temp\pub2.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1664

C:\Users\Admin\AppData\Local\Temp\mmt.exe
"C:\Users\Admin\AppData\Local\Temp\mmt.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Users\Admin\AppData\Local\Temp\3RILY6ZTD9\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\3RILY6ZTD9\multitimer.exe" 0 30601988b56f78c9.53290271 0 102
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1392

C:\Users\Admin\AppData\Local\Temp\3RILY6ZTD9\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\3RILY6ZTD9\multitimer.exe" 1 102
4⤵
PID:2456

C:\Users\Admin\AppData\Local\Temp\R9NPTLTWI3\setups.exe
"C:\Users\Admin\AppData\Local\Temp\R9NPTLTWI3\setups.exe" ll
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532

C:\Users\Admin\AppData\Local\Temp\is-QVJPH.tmp\setups.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QVJPH.tmp\setups.tmp" /SL5="$101CC,381442,156160,C:\Users\Admin\AppData\Local\Temp\R9NPTLTWI3\setups.exe" ll
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1276

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://catser.inappapiurl.com/redirect/57a764d042bf8/
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1616

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712

C:\Users\Admin\AppData\Local\Temp\pzysgf.exe
"C:\Users\Admin\AppData\Local\Temp\pzysgf.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1528

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:1196

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:2960

C:\Users\Admin\AppData\Local\Temp\{TIga-HI1rF-1Gie-aMeAP}\33473834218.exe
"C:\Users\Admin\AppData\Local\Temp\{TIga-HI1rF-1Gie-aMeAP}\33473834218.exe" /mix
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3028

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery