blacknet | 65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

System Information Discovery

Processes:

Godipacoshae.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Godipacoshae.exe

Loads dropped DLL 17 IoCs

Processes:

Install.tmprundll32.exetoolspab1.exePING.EXE70BF.exevsuwtbhvsuwtbhvsuwtbh

pid	process
1488	Install.tmp
4620	rundll32.exe
4148	toolspab1.exe
5644	PING.EXE
5644	PING.EXE
5644	PING.EXE
5644	PING.EXE
5644	PING.EXE
4648	70BF.exe
4648	70BF.exe
4648	70BF.exe
4648	70BF.exe
4648	70BF.exe
4648	70BF.exe
4200	vsuwtbh
5980	vsuwtbh
4996	vsuwtbh

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

7266.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	7266.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\7266.exe = "0"	7266.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	7266.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	7266.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	7266.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	7266.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	7266.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	7266.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	7266.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	7266.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

848A.exeUltra.exegpooe.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Local\\Chrome.exe\""	848A.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows NT\\Mimubygufi.exe\""	Ultra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gpooe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

md1_1eaf.exemd2_2efs.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md1_1eaf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md2_2efs.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

66 ip-api.com
254 api.myip.com
255 api.myip.com
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent A8A7CB5E57BA0575 svchost.exe

flow	ioc
66	ip-api.com
254	api.myip.com
255	api.myip.com

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent A8A7CB5E57BA0575	svchost.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

svchost.exe814833756.exetoolspab1.exeBBCbrowser.exe1063282496.exe7266.exe790E.exe848A.exevsuwtbhvsuwtbhvsuwtbh

description	pid	process	target process
PID 3736 set thread context of 2120	3736	svchost.exe	svchost.exe
PID 4100 set thread context of 5488	4100	814833756.exe	AddInProcess32.exe
PID 4776 set thread context of 4148	4776	toolspab1.exe	toolspab1.exe
PID 5732 set thread context of 3332	5732	BBCbrowser.exe	AddInProcess32.exe
PID 4408 set thread context of 5216	4408	1063282496.exe	AddInProcess32.exe
PID 4280 set thread context of 2680	4280	7266.exe	7266.exe
PID 5396 set thread context of 2152	5396	790E.exe	790E.exe
PID 4632 set thread context of 5944	4632	848A.exe	InstallUtil.exe
PID 3364 set thread context of 4200	3364	vsuwtbh	vsuwtbh
PID 4984 set thread context of 5980	4984	vsuwtbh	vsuwtbh
PID 4704 set thread context of 4996	4704	vsuwtbh	vsuwtbh

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\s10bmrce.w4b\skipper.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\s10bmrce.w4b\skipper.exe	autoit_exe

Drops file in Program Files directory 12 IoCs

Processes:

google-game.exeultramediaburner.tmpUltra.exe

description	ioc	process
File created	C:\Program Files\install.dat	google-game.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-EU4MP.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-7GPF4.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows NT\Mimubygufi.exe	Ultra.exe
File created	C:\Program Files (x86)\Windows NT\Mimubygufi.exe.config	Ultra.exe
File created	C:\Program Files\nvsmartmax.dll	google-game.exe
File created	C:\Program Files\Windows Defender\JVAQOOSNAD\ultramediaburner.exe	Ultra.exe
File created	C:\Program Files\Windows Defender\JVAQOOSNAD\ultramediaburner.exe.config	Ultra.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files\install.dll	google-game.exe

Drops file in Windows directory 2 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

MicrosoftEdgeCP.exetoolspab1.exevsuwtbhvsuwtbhvsuwtbh

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000A	MicrosoftEdgeCP.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000A	MicrosoftEdgeCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	MicrosoftEdgeCP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	MicrosoftEdgeCP.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vsuwtbh

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

5240 timeout.exe
2076 timeout.exe

pid	process
5240	timeout.exe
2076	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

MicrosoftEdgeCP.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MicrosoftEdgeCP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	MicrosoftEdgeCP.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4744 taskkill.exe

pid	process
4744	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

browser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{DAACE3B2-022D-4DB8-9A0F-FA91FB9E15EC}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "79"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000a8a014a3ca5c8d737a7485489d49a6f6e8759824feec7373c793bb37757b86e77030b07471cd430064c2466abd277ea05f24a09d5047c91e7da0	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "158"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 89e52eb4b73cd701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\Total = "118"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 243688a2b53cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "206"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1073"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-0876022 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\ = "281"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 20179f763054d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\enlisted.net\Total = "158"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "234"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Godipacoshae.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Godipacoshae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Godipacoshae.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5524 PING.EXE
5644 PING.EXE

pid	process
5524	PING.EXE
5644	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ultramediaburner.tmpQiwajaenazhu.exe

pid	process
1416	ultramediaburner.tmp
1416	ultramediaburner.tmp
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe
4052	Qiwajaenazhu.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2504

pid	process
2504

Suspicious behavior: MapViewOfSection 44 IoCs

Processes:

MicrosoftEdgeCP.exetoolspab1.exevsuwtbhvsuwtbhexplorer.exeexplorer.exeexplorer.exeMicrosoftEdgeCP.exevsuwtbh

pid	process
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4148	toolspab1.exe
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
2504
4200	vsuwtbh
5980	vsuwtbh
5036	explorer.exe
5036	explorer.exe
5036	explorer.exe
5036	explorer.exe
5228	explorer.exe
5228	explorer.exe
5228	explorer.exe
5228	explorer.exe
5172	explorer.exe
5172	explorer.exe
5172	explorer.exe
5172	explorer.exe
5724	MicrosoftEdgeCP.exe
5724	MicrosoftEdgeCP.exe
5036	explorer.exe
5036	explorer.exe
5228	explorer.exe
5228	explorer.exe
5172	explorer.exe
5172	explorer.exe
4996	vsuwtbh

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Ultra.exeGodipacoshae.exeQiwajaenazhu.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe814833756.exerundll32.exesvchost.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3984	Ultra.exe
Token: SeDebugPrivilege	2804	Godipacoshae.exe
Token: SeDebugPrivilege	4052	Qiwajaenazhu.exe
Token: SeDebugPrivilege	2856	MicrosoftEdge.exe
Token: SeDebugPrivilege	2856	MicrosoftEdge.exe
Token: SeDebugPrivilege	2856	MicrosoftEdge.exe
Token: SeDebugPrivilege	2856	MicrosoftEdge.exe
Token: SeDebugPrivilege	4484	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4484	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4484	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4484	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4100	814833756.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeTcbPrivilege	3736	svchost.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeAuditPrivilege	2300	svchost.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeAuditPrivilege	2300	svchost.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2548	svchost.exe
Token: SeIncreaseQuotaPrivilege	2548	svchost.exe
Token: SeSecurityPrivilege	2548	svchost.exe
Token: SeTakeOwnershipPrivilege	2548	svchost.exe
Token: SeLoadDriverPrivilege	2548	svchost.exe
Token: SeSystemtimePrivilege	2548	svchost.exe
Token: SeBackupPrivilege	2548	svchost.exe
Token: SeRestorePrivilege	2548	svchost.exe
Token: SeShutdownPrivilege	2548	svchost.exe
Token: SeSystemEnvironmentPrivilege	2548	svchost.exe
Token: SeUndockPrivilege	2548	svchost.exe
Token: SeManageVolumePrivilege	2548	svchost.exe
Token: SeDebugPrivilege	4620	rundll32.exe
Token: SeAuditPrivilege	2300	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2548	svchost.exe
Token: SeIncreaseQuotaPrivilege	2548	svchost.exe
Token: SeSecurityPrivilege	2548	svchost.exe
Token: SeTakeOwnershipPrivilege	2548	svchost.exe
Token: SeLoadDriverPrivilege	2548	svchost.exe
Token: SeSystemtimePrivilege	2548	svchost.exe
Token: SeBackupPrivilege	2548	svchost.exe
Token: SeRestorePrivilege	2548	svchost.exe
Token: SeShutdownPrivilege	2548	svchost.exe
Token: SeSystemEnvironmentPrivilege	2548	svchost.exe
Token: SeUndockPrivilege	2548	svchost.exe
Token: SeManageVolumePrivilege	2548	svchost.exe
Token: SeAuditPrivilege	2300	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2548	svchost.exe
Token: SeIncreaseQuotaPrivilege	2548	svchost.exe
Token: SeSecurityPrivilege	2548	svchost.exe
Token: SeTakeOwnershipPrivilege	2548	svchost.exe
Token: SeLoadDriverPrivilege	2548	svchost.exe
Token: SeSystemtimePrivilege	2548	svchost.exe
Token: SeBackupPrivilege	2548	svchost.exe
Token: SeRestorePrivilege	2548	svchost.exe
Token: SeShutdownPrivilege	2548	svchost.exe
Token: SeSystemEnvironmentPrivilege	2548	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ultramediaburner.tmp

pid process

1416 ultramediaburner.tmp

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exeInstallUtil.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
2856	MicrosoftEdge.exe
4220	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4788	google-game.exe
4788	google-game.exe
5944	InstallUtil.exe
5944	InstallUtil.exe
2856	MicrosoftEdge.exe
5724	MicrosoftEdgeCP.exe
5724	MicrosoftEdgeCP.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2504

pid	process
2504

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Install.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpQiwajaenazhu.execmd.execmd.execmd.exeskipper.exegpooe.exeMicrosoftEdgeCP.execmd.exegoogle-game.exerundll32.exesvchost.exe

description	pid	process	target process
PID 3968 wrote to memory of 1488	3968	Install.exe	Install.tmp
PID 3968 wrote to memory of 1488	3968	Install.exe	Install.tmp
PID 3968 wrote to memory of 1488	3968	Install.exe	Install.tmp
PID 1488 wrote to memory of 3984	1488	Install.tmp	Ultra.exe
PID 1488 wrote to memory of 3984	1488	Install.tmp	Ultra.exe
PID 3984 wrote to memory of 2884	3984	Ultra.exe	ultramediaburner.exe
PID 3984 wrote to memory of 2884	3984	Ultra.exe	ultramediaburner.exe
PID 3984 wrote to memory of 2884	3984	Ultra.exe	ultramediaburner.exe
PID 2884 wrote to memory of 1416	2884	ultramediaburner.exe	ultramediaburner.tmp
PID 2884 wrote to memory of 1416	2884	ultramediaburner.exe	ultramediaburner.tmp
PID 2884 wrote to memory of 1416	2884	ultramediaburner.exe	ultramediaburner.tmp
PID 1416 wrote to memory of 3496	1416	ultramediaburner.tmp	UltraMediaBurner.exe
PID 1416 wrote to memory of 3496	1416	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3984 wrote to memory of 2804	3984	Ultra.exe	Godipacoshae.exe
PID 3984 wrote to memory of 2804	3984	Ultra.exe	Godipacoshae.exe
PID 3984 wrote to memory of 4052	3984	Ultra.exe	Qiwajaenazhu.exe
PID 3984 wrote to memory of 4052	3984	Ultra.exe	Qiwajaenazhu.exe
PID 4052 wrote to memory of 4980	4052	Qiwajaenazhu.exe	cmd.exe
PID 4052 wrote to memory of 4980	4052	Qiwajaenazhu.exe	cmd.exe
PID 4980 wrote to memory of 5112	4980	cmd.exe	skipper.exe
PID 4980 wrote to memory of 5112	4980	cmd.exe	skipper.exe
PID 4980 wrote to memory of 5112	4980	cmd.exe	skipper.exe
PID 4052 wrote to memory of 4260	4052	Qiwajaenazhu.exe	cmd.exe
PID 4052 wrote to memory of 4260	4052	Qiwajaenazhu.exe	cmd.exe
PID 4260 wrote to memory of 4428	4260	cmd.exe	backgroundTaskHost.exe
PID 4260 wrote to memory of 4428	4260	cmd.exe	backgroundTaskHost.exe
PID 4260 wrote to memory of 4428	4260	cmd.exe	backgroundTaskHost.exe
PID 4052 wrote to memory of 4916	4052	Qiwajaenazhu.exe	cmd.exe
PID 4052 wrote to memory of 4916	4052	Qiwajaenazhu.exe	cmd.exe
PID 4916 wrote to memory of 4992	4916	cmd.exe	gpooe.exe
PID 4916 wrote to memory of 4992	4916	cmd.exe	gpooe.exe
PID 4916 wrote to memory of 4992	4916	cmd.exe	gpooe.exe
PID 5112 wrote to memory of 4100	5112	skipper.exe	814833756.exe
PID 5112 wrote to memory of 4100	5112	skipper.exe	814833756.exe
PID 5112 wrote to memory of 4100	5112	skipper.exe	814833756.exe
PID 4992 wrote to memory of 4156	4992	gpooe.exe	jfiag3g_gg.exe
PID 4992 wrote to memory of 4156	4992	gpooe.exe	jfiag3g_gg.exe
PID 4992 wrote to memory of 4156	4992	gpooe.exe	jfiag3g_gg.exe
PID 4220 wrote to memory of 4484	4220	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4220 wrote to memory of 4484	4220	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4220 wrote to memory of 4484	4220	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4052 wrote to memory of 4680	4052	Qiwajaenazhu.exe	cmd.exe
PID 4052 wrote to memory of 4680	4052	Qiwajaenazhu.exe	cmd.exe
PID 4680 wrote to memory of 4788	4680	cmd.exe	google-game.exe
PID 4680 wrote to memory of 4788	4680	cmd.exe	google-game.exe
PID 4680 wrote to memory of 4788	4680	cmd.exe	google-game.exe
PID 4788 wrote to memory of 4620	4788	google-game.exe	rundll32.exe
PID 4788 wrote to memory of 4620	4788	google-game.exe	rundll32.exe
PID 4788 wrote to memory of 4620	4788	google-game.exe	rundll32.exe
PID 4620 wrote to memory of 3736	4620	rundll32.exe	svchost.exe
PID 4620 wrote to memory of 2536	4620	rundll32.exe	svchost.exe
PID 3736 wrote to memory of 2120	3736	svchost.exe	svchost.exe
PID 3736 wrote to memory of 2120	3736	svchost.exe	svchost.exe
PID 3736 wrote to memory of 2120	3736	svchost.exe	svchost.exe
PID 4620 wrote to memory of 984	4620	rundll32.exe	svchost.exe
PID 4620 wrote to memory of 2316	4620	rundll32.exe	svchost.exe
PID 4052 wrote to memory of 4348	4052	Qiwajaenazhu.exe	explorer.exe
PID 4052 wrote to memory of 4348	4052	Qiwajaenazhu.exe	explorer.exe
PID 4620 wrote to memory of 2300	4620	rundll32.exe	svchost.exe
PID 4620 wrote to memory of 1064	4620	rundll32.exe	svchost.exe
PID 4620 wrote to memory of 824	4620	rundll32.exe	svchost.exe
PID 4620 wrote to memory of 1404	4620	rundll32.exe	svchost.exe
PID 4620 wrote to memory of 1916	4620	rundll32.exe	svchost.exe
PID 4052 wrote to memory of 4188	4052	Qiwajaenazhu.exe	cmd.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:984

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2556

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2536

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2316

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2300

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1916

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1236

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1064

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:824

C:\Users\Admin\AppData\Roaming\vsuwtbh
C:\Users\Admin\AppData\Roaming\vsuwtbh
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3364

C:\Users\Admin\AppData\Roaming\vsuwtbh
C:\Users\Admin\AppData\Roaming\vsuwtbh
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4200

C:\Users\Admin\AppData\Roaming\vsuwtbh
C:\Users\Admin\AppData\Roaming\vsuwtbh
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4984

C:\Users\Admin\AppData\Roaming\vsuwtbh
C:\Users\Admin\AppData\Roaming\vsuwtbh
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5980

C:\Users\Admin\AppData\Roaming\vsuwtbh
C:\Users\Admin\AppData\Roaming\vsuwtbh
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4704

C:\Users\Admin\AppData\Roaming\vsuwtbh
C:\Users\Admin\AppData\Roaming\vsuwtbh
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4996

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Users\Admin\AppData\Local\Temp\is-3PGH7.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-3PGH7.tmp\Install.tmp" /SL5="$90064,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\is-OPIMK.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-OPIMK.tmp\Ultra.exe" /S /UID=burnerch1
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984

C:\Program Files\Windows Defender\JVAQOOSNAD\ultramediaburner.exe
"C:\Program Files\Windows Defender\JVAQOOSNAD\ultramediaburner.exe" /VERYSILENT
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884

C:\Users\Admin\AppData\Local\Temp\is-M2MN4.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M2MN4.tmp\ultramediaburner.tmp" /SL5="$5006C,281924,62464,C:\Program Files\Windows Defender\JVAQOOSNAD\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1416

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
6⤵
- Executes dropped EXE
PID:3496

C:\Users\Admin\AppData\Local\Temp\d5-55d32-fa7-2b4b3-367dc4d6c2b32\Godipacoshae.exe
"C:\Users\Admin\AppData\Local\Temp\d5-55d32-fa7-2b4b3-367dc4d6c2b32\Godipacoshae.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Users\Admin\AppData\Local\Temp\e7-e1727-360-a95b6-13f88b9e11592\Qiwajaenazhu.exe
"C:\Users\Admin\AppData\Local\Temp\e7-e1727-360-a95b6-13f88b9e11592\Qiwajaenazhu.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s10bmrce.w4b\skipper.exe /s & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Users\Admin\AppData\Local\Temp\s10bmrce.w4b\skipper.exe
C:\Users\Admin\AppData\Local\Temp\s10bmrce.w4b\skipper.exe /s
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\814833756.exe
C:\Users\Admin\AppData\Local\Temp\814833756.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:5488

C:\Users\Admin\AppData\Local\Temp\1063282496.exe
C:\Users\Admin\AppData\Local\Temp\1063282496.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:5216

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\s10bmrce.w4b\skipper.exe & exit
7⤵
PID:6036

C:\Windows\SysWOW64\PING.EXE
ping 0
8⤵
- Runs ping.exe
PID:5524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\03dq4lsn.hqc\001.exe & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4260

C:\Users\Admin\AppData\Local\Temp\03dq4lsn.hqc\001.exe
C:\Users\Admin\AppData\Local\Temp\03dq4lsn.hqc\001.exe
6⤵
PID:4428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yogqm0oo.v0d\gpooe.exe & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4916

C:\Users\Admin\AppData\Local\Temp\yogqm0oo.v0d\gpooe.exe
C:\Users\Admin\AppData\Local\Temp\yogqm0oo.v0d\gpooe.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4992

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:4156

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5512

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:4008

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yyztvgne.ci0\google-game.exe & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Users\Admin\AppData\Local\Temp\yyztvgne.ci0\google-game.exe
C:\Users\Admin\AppData\Local\Temp\yyztvgne.ci0\google-game.exe
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
7⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\omvkbfqe.ovm\md1_1eaf.exe & exit
5⤵
PID:4348

C:\Users\Admin\AppData\Local\Temp\omvkbfqe.ovm\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\omvkbfqe.ovm\md1_1eaf.exe
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vrk4sh02.wnx\HookSetp.exe /silent & exit
5⤵
PID:4188

C:\Users\Admin\AppData\Local\Temp\vrk4sh02.wnx\HookSetp.exe
C:\Users\Admin\AppData\Local\Temp\vrk4sh02.wnx\HookSetp.exe /silent
6⤵
- Executes dropped EXE
PID:5260

C:\Users\Admin\AppData\Roaming\1826618.exe
"C:\Users\Admin\AppData\Roaming\1826618.exe"
7⤵
- Executes dropped EXE
PID:6040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3xrkmcdr.4my\BBCbrowser.exe /VERYSILENT & exit
5⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\3xrkmcdr.4my\BBCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\3xrkmcdr.4my\BBCbrowser.exe /VERYSILENT
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
PID:3332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
7⤵
PID:2868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o24pkssx.ekn\md2_2efs.exe & exit
5⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\o24pkssx.ekn\md2_2efs.exe
C:\Users\Admin\AppData\Local\Temp\o24pkssx.ekn\md2_2efs.exe
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5676

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qqeypimj.ml1\askinstall39.exe & exit
5⤵
PID:5728

C:\Users\Admin\AppData\Local\Temp\qqeypimj.ml1\askinstall39.exe
C:\Users\Admin\AppData\Local\Temp\qqeypimj.ml1\askinstall39.exe
6⤵
- Executes dropped EXE
PID:6016

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:6072

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
PID:2132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:4744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qzwhco0k.pz1\y1.exe & exit
5⤵
PID:6076

C:\Users\Admin\AppData\Local\Temp\qzwhco0k.pz1\y1.exe
C:\Users\Admin\AppData\Local\Temp\qzwhco0k.pz1\y1.exe
6⤵
PID:5644

C:\Users\Admin\AppData\Local\Temp\LOUhIvIsws.exe
"C:\Users\Admin\AppData\Local\Temp\LOUhIvIsws.exe"
7⤵
PID:4548

C:\Users\Admin\AppData\Roaming\1619672914052.exe
"C:\Users\Admin\AppData\Roaming\1619672914052.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619672914052.txt"
8⤵
PID:5740

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\LOUhIvIsws.exe"
8⤵
PID:4392

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Runs ping.exe
PID:5644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\qzwhco0k.pz1\y1.exe"
7⤵
PID:4008

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
8⤵
- Delays execution with timeout.exe
PID:5240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p0orl5i4.3if\jvppp.exe & exit
5⤵
PID:5960

C:\Users\Admin\AppData\Local\Temp\p0orl5i4.3if\jvppp.exe
C:\Users\Admin\AppData\Local\Temp\p0orl5i4.3if\jvppp.exe
6⤵
- Executes dropped EXE
PID:5616

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:6140

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5792

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5704

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:4448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g2oqvinf.snk\GcleanerWW.exe /mixone & exit
5⤵
PID:5808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h21sxydu.1oc\toolspab1.exe & exit
5⤵
PID:5140

C:\Users\Admin\AppData\Local\Temp\h21sxydu.1oc\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\h21sxydu.1oc\toolspab1.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4776

C:\Users\Admin\AppData\Local\Temp\h21sxydu.1oc\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\h21sxydu.1oc\toolspab1.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4148

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wa2w5w0u.2yh\005.exe & exit
5⤵
PID:2132

C:\Users\Admin\AppData\Local\Temp\wa2w5w0u.2yh\005.exe
C:\Users\Admin\AppData\Local\Temp\wa2w5w0u.2yh\005.exe
6⤵
- Executes dropped EXE
PID:5508

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2120

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2856

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3224

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
1⤵
- Executes dropped EXE
PID:4428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5316

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5472

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5884

C:\Users\Admin\AppData\Local\Temp\5C69.exe
C:\Users\Admin\AppData\Local\Temp\5C69.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Users\Admin\AppData\Local\Temp\664D.exe
C:\Users\Admin\AppData\Local\Temp\664D.exe
1⤵
- Executes dropped EXE
PID:4236

C:\Users\Admin\AppData\Local\Temp\6A46.exe
C:\Users\Admin\AppData\Local\Temp\6A46.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Users\Admin\AppData\Local\Temp\70BF.exe
C:\Users\Admin\AppData\Local\Temp\70BF.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4648

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\70BF.exe"
2⤵
PID:6064

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
- Executes dropped EXE
PID:4548

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:2076

C:\Users\Admin\AppData\Local\Temp\7266.exe
C:\Users\Admin\AppData\Local\Temp\7266.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
PID:4280

C:\Users\Admin\AppData\Local\Temp\8f85e24f-0977-4562-9428-19c1ea795d4a\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\8f85e24f-0977-4562-9428-19c1ea795d4a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8f85e24f-0977-4562-9428-19c1ea795d4a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
PID:5452

C:\Users\Admin\AppData\Local\Temp\8f85e24f-0977-4562-9428-19c1ea795d4a\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\8f85e24f-0977-4562-9428-19c1ea795d4a\AdvancedRun.exe" /SpecialRun 4101d8 5452
3⤵
- Executes dropped EXE
PID:5760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7266.exe" -Force
2⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\7266.exe
"C:\Users\Admin\AppData\Local\Temp\7266.exe"
2⤵
- Executes dropped EXE
PID:4024

C:\Users\Admin\AppData\Local\Temp\7266.exe
"C:\Users\Admin\AppData\Local\Temp\7266.exe"
2⤵
- Executes dropped EXE
PID:2680

C:\Users\Admin\AppData\Local\Temp\790E.exe
C:\Users\Admin\AppData\Local\Temp\790E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5396

C:\Users\Admin\AppData\Local\Temp\790E.exe
"{path}"
2⤵
- Executes dropped EXE
PID:2152

C:\Users\Admin\AppData\Local\Temp\7CF7.exe
C:\Users\Admin\AppData\Local\Temp\7CF7.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Users\Admin\AppData\Local\Temp\848A.exe
C:\Users\Admin\AppData\Local\Temp\848A.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:4632

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
2⤵
- Executes dropped EXE
PID:1944

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5944

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5492

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4372

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5036

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5964

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5228

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5268

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5172

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4348

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2856

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5724

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5632

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

System Information Discovery