dcrat | 65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

System Information Discovery

Processes:

Qavanaevaeji.exekeygen-step-4d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Qavanaevaeji.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	keygen-step-4d.exe

Loads dropped DLL 9 IoCs

Processes:

rundll32.exeInstall.tmpjg6_6asg.exetoolspab1.exey1.exe4E5A.exebaejifrbaejifrbaejifr

pid process

3272 rundll32.exe
2876 Install.tmp
4756 jg6_6asg.exe
5204 toolspab1.exe
3044 y1.exe
5432 4E5A.exe
4632 baejifr
4176 baejifr
6080 baejifr
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

506F.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	506F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	506F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	506F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	506F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	506F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	506F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\506F.exe = "0"	506F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	506F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	506F.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	506F.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

1501.tmp.exeUltra.exegpooe.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	1501.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\waupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\waupdat3.exe"	1501.tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ZHahixaebaerae.exe\""	Ultra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gpooe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

md2_2efs.exejg6_6asg.exemd1_1eaf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md2_2efs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg6_6asg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md1_1eaf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

111 ip-api.com
131 api.ipify.org
233 api.myip.com
234 api.myip.com
Drops file in System32 directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 4BF4514B8F5894A4 svchost.exe

flow	ioc
111	ip-api.com
131	api.ipify.org
233	api.myip.com
234	api.myip.com

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 4BF4514B8F5894A4	svchost.exe

Suspicious use of SetThreadContext 13 IoCs

Processes:

svchost.exe1127.tmp.exeaskinstall39.exe1501.tmp.exe2125836461.exetoolspab1.exeBBCbrowser.exe506F.exe567B.exebaejifrbaejifrbaejifr

description	pid	process	target process
PID 1048 set thread context of 4072	1048	svchost.exe	svchost.exe
PID 4652 set thread context of 4512	4652	1127.tmp.exe	1127.tmp.exe
PID 4496 set thread context of 5152	4496	askinstall39.exe	AddInProcess32.exe
PID 2912 set thread context of 5888	2912	1501.tmp.exe	msiexec.exe
PID 2912 set thread context of 4460	2912	1501.tmp.exe	msiexec.exe
PID 4344 set thread context of 4696	4344	2125836461.exe	AddInProcess32.exe
PID 6004 set thread context of 5204	6004	toolspab1.exe	toolspab1.exe
PID 5716 set thread context of 5264	5716	BBCbrowser.exe	AddInProcess32.exe
PID 5624 set thread context of 5060	5624	506F.exe	506F.exe
PID 5980 set thread context of 5916	5980	567B.exe	567B.exe
PID 4268 set thread context of 4632	4268	baejifr	baejifr
PID 5752 set thread context of 4176	5752	baejifr	baejifr
PID 4172 set thread context of 6080	4172	baejifr	baejifr

Drops file in Program Files directory 13 IoCs

Processes:

xiuhuali.exeultramediaburner.tmpUltra.exegoogle-game.exe

description	ioc	process
File created	C:\Program Files\install.dat	xiuhuali.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-IFHV1.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows Photo Viewer\ZHahixaebaerae.exe	Ultra.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ZHahixaebaerae.exe.config	Ultra.exe
File created	C:\Program Files\install.dat	google-game.exe
File created	C:\Program Files\libEGL.dll	xiuhuali.exe
File created	C:\Program Files\install.dll	xiuhuali.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-5DRT1.tmp	ultramediaburner.tmp
File created	C:\Program Files\nvsmartmax.dll	google-game.exe
File opened for modification	C:\Program Files\install.dll	google-game.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

baejifrtoolspab1.exebaejifrbaejifr

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspab1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	baejifr

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

4984 timeout.exe
4904 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4532 taskkill.exe

pid	process
4984	timeout.exe
4904	timeout.exe

pid	process
4532	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

Processes:

browser_broker.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exePING.EXEMicrosoftEdgeCP.exeMicrosoftEdgeCP.exejg6_6asg.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "326520226"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000007707181af2aa9ed81568ba698beb813ffc26413d301b4d24c61fc5dd8eef0132e425a903454390f39fa7a090174eb7cccc1e66aaea5f9444695031b45f3723123552587bcba665587e6c6796935e7721e03c8d4d4f0c4172e86	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	PING.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "1256"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74WP1CM3-506M-V62R-WR42-7MQP227Y2YLP}	jg6_6asg.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{CE1D0D32-190E-486E-9D2A-DB85FB53EF56}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{37B78CE2-6A1A-418F-89E1-1C4FD2002B9B} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

q5Hz0mxRkl.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	q5Hz0mxRkl.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	q5Hz0mxRkl.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

4932 PING.EXE
4704 PING.EXE
5812 PING.EXE

pid	process
4932	PING.EXE
4704	PING.EXE
5812	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exesvchost.exeultramediaburner.tmpLaebozhuvaefae.exe

pid	process
3272	rundll32.exe
3272	rundll32.exe
1048	svchost.exe
1048	svchost.exe
4012	ultramediaburner.tmp
4012	ultramediaburner.tmp
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe
1184	Laebozhuvaefae.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3056

pid	process
3056

Suspicious behavior: MapViewOfSection 57 IoCs

Processes:

PING.EXEtoolspab1.exeMicrosoftEdgeCP.exeexplorer.exeexplorer.exeexplorer.exebaejifrMicrosoftEdgeCP.exebaejifrbaejifr

pid	process
4704	PING.EXE
4704	PING.EXE
5204	toolspab1.exe
5932	MicrosoftEdgeCP.exe
3056
3056
3056
3056
3056
3056
3056
3056
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
3056
3056
3056
3056
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
3056
3056
3056
3056
6032	explorer.exe
6032	explorer.exe
6032	explorer.exe
6032	explorer.exe
3056
3056
4632	baejifr
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
5504	explorer.exe
6032	explorer.exe
6032	explorer.exe
6032	explorer.exe
6032	explorer.exe
5232	MicrosoftEdgeCP.exe
5232	MicrosoftEdgeCP.exe
4176	baejifr
4784	explorer.exe
4784	explorer.exe
5504	explorer.exe
5504	explorer.exe
6032	explorer.exe
6032	explorer.exe
6080	baejifr

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

rundll32.exesvchost.exeJoSetp.exeUltra.exesvchost.exeQavanaevaeji.exeLaebozhuvaefae.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeTcbPrivilege	1048	svchost.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	576	JoSetp.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3272	rundll32.exe
Token: SeDebugPrivilege	3364	Ultra.exe
Token: SeAuditPrivilege	2416	svchost.exe
Token: SeDebugPrivilege	3272	Qavanaevaeji.exe
Token: SeDebugPrivilege	1184	Laebozhuvaefae.exe
Token: SeAssignPrimaryTokenPrivilege	2696	svchost.exe
Token: SeIncreaseQuotaPrivilege	2696	svchost.exe
Token: SeSecurityPrivilege	2696	svchost.exe
Token: SeTakeOwnershipPrivilege	2696	svchost.exe
Token: SeLoadDriverPrivilege	2696	svchost.exe
Token: SeSystemtimePrivilege	2696	svchost.exe
Token: SeBackupPrivilege	2696	svchost.exe
Token: SeRestorePrivilege	2696	svchost.exe
Token: SeShutdownPrivilege	2696	svchost.exe
Token: SeSystemEnvironmentPrivilege	2696	svchost.exe
Token: SeUndockPrivilege	2696	svchost.exe
Token: SeManageVolumePrivilege	2696	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2696	svchost.exe
Token: SeIncreaseQuotaPrivilege	2696	svchost.exe
Token: SeSecurityPrivilege	2696	svchost.exe
Token: SeTakeOwnershipPrivilege	2696	svchost.exe
Token: SeLoadDriverPrivilege	2696	svchost.exe
Token: SeSystemtimePrivilege	2696	svchost.exe
Token: SeBackupPrivilege	2696	svchost.exe
Token: SeRestorePrivilege	2696	svchost.exe
Token: SeShutdownPrivilege	2696	svchost.exe
Token: SeSystemEnvironmentPrivilege	2696	svchost.exe
Token: SeUndockPrivilege	2696	svchost.exe
Token: SeManageVolumePrivilege	2696	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2696	svchost.exe
Token: SeIncreaseQuotaPrivilege	2696	svchost.exe
Token: SeSecurityPrivilege	2696	svchost.exe
Token: SeTakeOwnershipPrivilege	2696	svchost.exe
Token: SeLoadDriverPrivilege	2696	svchost.exe
Token: SeSystemtimePrivilege	2696	svchost.exe
Token: SeBackupPrivilege	2696	svchost.exe
Token: SeRestorePrivilege	2696	svchost.exe
Token: SeShutdownPrivilege	2696	svchost.exe
Token: SeSystemEnvironmentPrivilege	2696	svchost.exe
Token: SeUndockPrivilege	2696	svchost.exe
Token: SeManageVolumePrivilege	2696	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2696	svchost.exe
Token: SeIncreaseQuotaPrivilege	2696	svchost.exe
Token: SeSecurityPrivilege	2696	svchost.exe
Token: SeTakeOwnershipPrivilege	2696	svchost.exe
Token: SeLoadDriverPrivilege	2696	svchost.exe
Token: SeSystemtimePrivilege	2696	svchost.exe
Token: SeBackupPrivilege	2696	svchost.exe
Token: SeRestorePrivilege	2696	svchost.exe
Token: SeShutdownPrivilege	2696	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ultramediaburner.tmp

pid process

4012 ultramediaburner.tmp

pid	process
4012	ultramediaburner.tmp

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

xiuhuali.exeMicrosoftEdge.exePING.EXEgoogle-game.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
2104	xiuhuali.exe
2104	xiuhuali.exe
4676	MicrosoftEdge.exe
4704	PING.EXE
4704	PING.EXE
6008	google-game.exe
6008	google-game.exe
4828	MicrosoftEdge.exe
5932	MicrosoftEdgeCP.exe
5932	MicrosoftEdgeCP.exe
5224	MicrosoftEdge.exe
5232	MicrosoftEdgeCP.exe
5232	MicrosoftEdgeCP.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3056

pid	process
3056

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

keygen-step-4d.exexiuhuali.exerundll32.exesvchost.exeInstall.exeInstall.tmpUltra.exeultramediaburner.exeultramediaburner.tmpLaebozhuvaefae.execmd.execmd.exeskipper.exePING.EXE

description	pid	process	target process
PID 856 wrote to memory of 2104	856	keygen-step-4d.exe	xiuhuali.exe
PID 856 wrote to memory of 2104	856	keygen-step-4d.exe	xiuhuali.exe
PID 856 wrote to memory of 2104	856	keygen-step-4d.exe	xiuhuali.exe
PID 2104 wrote to memory of 3272	2104	xiuhuali.exe	rundll32.exe
PID 2104 wrote to memory of 3272	2104	xiuhuali.exe	rundll32.exe
PID 2104 wrote to memory of 3272	2104	xiuhuali.exe	rundll32.exe
PID 856 wrote to memory of 576	856	keygen-step-4d.exe	JoSetp.exe
PID 856 wrote to memory of 576	856	keygen-step-4d.exe	JoSetp.exe
PID 3272 wrote to memory of 1048	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 2580	3272	rundll32.exe	svchost.exe
PID 1048 wrote to memory of 4072	1048	svchost.exe	svchost.exe
PID 1048 wrote to memory of 4072	1048	svchost.exe	svchost.exe
PID 1048 wrote to memory of 4072	1048	svchost.exe	svchost.exe
PID 3272 wrote to memory of 340	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 2448	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 2416	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 1092	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 1036	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 1408	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 1936	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 1144	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 1396	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 2696	3272	rundll32.exe	svchost.exe
PID 3272 wrote to memory of 2708	3272	rundll32.exe	svchost.exe
PID 856 wrote to memory of 1736	856	keygen-step-4d.exe	Install.exe
PID 856 wrote to memory of 1736	856	keygen-step-4d.exe	Install.exe
PID 856 wrote to memory of 1736	856	keygen-step-4d.exe	Install.exe
PID 1736 wrote to memory of 2876	1736	Install.exe	Install.tmp
PID 1736 wrote to memory of 2876	1736	Install.exe	Install.tmp
PID 1736 wrote to memory of 2876	1736	Install.exe	Install.tmp
PID 2876 wrote to memory of 3364	2876	Install.tmp	Ultra.exe
PID 2876 wrote to memory of 3364	2876	Install.tmp	Ultra.exe
PID 3364 wrote to memory of 3360	3364	Ultra.exe	ultramediaburner.exe
PID 3364 wrote to memory of 3360	3364	Ultra.exe	ultramediaburner.exe
PID 3364 wrote to memory of 3360	3364	Ultra.exe	ultramediaburner.exe
PID 3360 wrote to memory of 4012	3360	ultramediaburner.exe	ultramediaburner.tmp
PID 3360 wrote to memory of 4012	3360	ultramediaburner.exe	ultramediaburner.tmp
PID 3360 wrote to memory of 4012	3360	ultramediaburner.exe	ultramediaburner.tmp
PID 3364 wrote to memory of 3272	3364	Ultra.exe	Qavanaevaeji.exe
PID 3364 wrote to memory of 3272	3364	Ultra.exe	Qavanaevaeji.exe
PID 4012 wrote to memory of 2716	4012	ultramediaburner.tmp	UltraMediaBurner.exe
PID 4012 wrote to memory of 2716	4012	ultramediaburner.tmp	UltraMediaBurner.exe
PID 3364 wrote to memory of 1184	3364	Ultra.exe	Laebozhuvaefae.exe
PID 3364 wrote to memory of 1184	3364	Ultra.exe	Laebozhuvaefae.exe
PID 856 wrote to memory of 508	856	keygen-step-4d.exe	filee.exe
PID 856 wrote to memory of 508	856	keygen-step-4d.exe	filee.exe
PID 856 wrote to memory of 508	856	keygen-step-4d.exe	filee.exe
PID 1184 wrote to memory of 5348	1184	Laebozhuvaefae.exe	cmd.exe
PID 1184 wrote to memory of 5348	1184	Laebozhuvaefae.exe	cmd.exe
PID 5348 wrote to memory of 5584	5348	cmd.exe	skipper.exe
PID 5348 wrote to memory of 5584	5348	cmd.exe	skipper.exe
PID 5348 wrote to memory of 5584	5348	cmd.exe	skipper.exe
PID 1184 wrote to memory of 5664	1184	Laebozhuvaefae.exe	cmd.exe
PID 1184 wrote to memory of 5664	1184	Laebozhuvaefae.exe	cmd.exe
PID 5664 wrote to memory of 5844	5664	cmd.exe	001.exe
PID 5664 wrote to memory of 5844	5664	cmd.exe	001.exe
PID 5664 wrote to memory of 5844	5664	cmd.exe	001.exe
PID 5584 wrote to memory of 4496	5584	skipper.exe	askinstall39.exe
PID 5584 wrote to memory of 4496	5584	skipper.exe	askinstall39.exe
PID 5584 wrote to memory of 4496	5584	skipper.exe	askinstall39.exe
PID 4704 wrote to memory of 4964	4704	PING.EXE	MicrosoftEdgeCP.exe
PID 4704 wrote to memory of 4964	4704	PING.EXE	MicrosoftEdgeCP.exe
PID 4704 wrote to memory of 4964	4704	PING.EXE	MicrosoftEdgeCP.exe
PID 1184 wrote to memory of 1156	1184	Laebozhuvaefae.exe	cmd.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1036

C:\Users\Admin\AppData\Roaming\baejifr
C:\Users\Admin\AppData\Roaming\baejifr
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4268

C:\Users\Admin\AppData\Roaming\baejifr
C:\Users\Admin\AppData\Roaming\baejifr
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4632

C:\Users\Admin\AppData\Roaming\baejifr
C:\Users\Admin\AppData\Roaming\baejifr
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5752

C:\Users\Admin\AppData\Roaming\baejifr
C:\Users\Admin\AppData\Roaming\baejifr
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4176

C:\Users\Admin\AppData\Roaming\baejifr
C:\Users\Admin\AppData\Roaming\baejifr
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4172

C:\Users\Admin\AppData\Roaming\baejifr
C:\Users\Admin\AppData\Roaming\baejifr
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6080

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1092

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1144

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1936

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2580

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Users\Admin\AppData\Local\Temp\keygen-step-4d.exe
"C:\Users\Admin\AppData\Local\Temp\keygen-step-4d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\xiuhuali.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272

C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\JoSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\is-4T5SA.tmp\Install.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4T5SA.tmp\Install.tmp" /SL5="$40192,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Local\Temp\is-P7UPG.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-P7UPG.tmp\Ultra.exe" /S /UID=burnerch1
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364

C:\Users\Admin\AppData\Local\Temp\RJUABGTIUF\ultramediaburner.exe
"C:\Users\Admin\AppData\Local\Temp\RJUABGTIUF\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360

C:\Users\Admin\AppData\Local\Temp\is-6BDU9.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-6BDU9.tmp\ultramediaburner.tmp" /SL5="$300F4,281924,62464,C:\Users\Admin\AppData\Local\Temp\RJUABGTIUF\ultramediaburner.exe" /VERYSILENT
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4012

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
7⤵
- Executes dropped EXE
PID:2716

C:\Users\Admin\AppData\Local\Temp\52-3ef4a-b85-09286-cccaf09bc6af8\Qavanaevaeji.exe
"C:\Users\Admin\AppData\Local\Temp\52-3ef4a-b85-09286-cccaf09bc6af8\Qavanaevaeji.exe"
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\Users\Admin\AppData\Local\Temp\86-48b6a-7c9-931b6-d588941418345\Laebozhuvaefae.exe
"C:\Users\Admin\AppData\Local\Temp\86-48b6a-7c9-931b6-d588941418345\Laebozhuvaefae.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tvbl22wk.wyw\skipper.exe /s & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:5348

C:\Users\Admin\AppData\Local\Temp\tvbl22wk.wyw\skipper.exe
C:\Users\Admin\AppData\Local\Temp\tvbl22wk.wyw\skipper.exe /s
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584

C:\Users\Admin\AppData\Local\Temp\784758187.exe
C:\Users\Admin\AppData\Local\Temp\784758187.exe
8⤵
PID:4496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
9⤵
PID:5152

C:\Users\Admin\AppData\Local\Temp\2125836461.exe
C:\Users\Admin\AppData\Local\Temp\2125836461.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
9⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\tvbl22wk.wyw\skipper.exe & exit
8⤵
PID:5740

C:\Windows\SysWOW64\PING.EXE
ping 0
9⤵
- Modifies registry class
- Runs ping.exe
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\03r5cegl.cje\001.exe & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:5664

C:\Users\Admin\AppData\Local\Temp\03r5cegl.cje\001.exe
C:\Users\Admin\AppData\Local\Temp\03r5cegl.cje\001.exe
7⤵
- Executes dropped EXE
PID:5844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\onhrq0lt.k0k\gpooe.exe & exit
6⤵
PID:1156

C:\Users\Admin\AppData\Local\Temp\onhrq0lt.k0k\gpooe.exe
C:\Users\Admin\AppData\Local\Temp\onhrq0lt.k0k\gpooe.exe
7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5012

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4420

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5596

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:6084

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c1fwitoc.dry\google-game.exe & exit
6⤵
PID:5832

C:\Users\Admin\AppData\Local\Temp\c1fwitoc.dry\google-game.exe
C:\Users\Admin\AppData\Local\Temp\c1fwitoc.dry\google-game.exe
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:6008

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
8⤵
PID:4756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gjphrc3h.e3w\md1_1eaf.exe & exit
6⤵
PID:4972

C:\Users\Admin\AppData\Local\Temp\gjphrc3h.e3w\md1_1eaf.exe
C:\Users\Admin\AppData\Local\Temp\gjphrc3h.e3w\md1_1eaf.exe
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2obiqr2o.w03\HookSetp.exe /silent & exit
6⤵
PID:5692

C:\Users\Admin\AppData\Local\Temp\2obiqr2o.w03\HookSetp.exe
C:\Users\Admin\AppData\Local\Temp\2obiqr2o.w03\HookSetp.exe /silent
7⤵
- Executes dropped EXE
PID:5700

C:\Users\Admin\AppData\Roaming\7606255.exe
"C:\Users\Admin\AppData\Roaming\7606255.exe"
8⤵
PID:5828

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\btndwkk4.nc5\BBCbrowser.exe /VERYSILENT & exit
6⤵
PID:5432

C:\Users\Admin\AppData\Local\Temp\btndwkk4.nc5\BBCbrowser.exe
C:\Users\Admin\AppData\Local\Temp\btndwkk4.nc5\BBCbrowser.exe /VERYSILENT
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
8⤵
PID:5264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z45zam2r.do5\md2_2efs.exe & exit
6⤵
PID:6140

C:\Users\Admin\AppData\Local\Temp\z45zam2r.do5\md2_2efs.exe
C:\Users\Admin\AppData\Local\Temp\z45zam2r.do5\md2_2efs.exe
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wpzemfdn.w25\askinstall39.exe & exit
6⤵
PID:5116

C:\Users\Admin\AppData\Local\Temp\wpzemfdn.w25\askinstall39.exe
C:\Users\Admin\AppData\Local\Temp\wpzemfdn.w25\askinstall39.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4496

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
8⤵
PID:5980

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
9⤵
- Kills process with taskkill
PID:4532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\do4sfvdf.b3l\y1.exe & exit
6⤵
PID:5308

C:\Users\Admin\AppData\Local\Temp\do4sfvdf.b3l\y1.exe
C:\Users\Admin\AppData\Local\Temp\do4sfvdf.b3l\y1.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044

C:\Users\Admin\AppData\Local\Temp\q5Hz0mxRkl.exe
"C:\Users\Admin\AppData\Local\Temp\q5Hz0mxRkl.exe"
8⤵
- Executes dropped EXE
- Modifies system certificate store
PID:4268

C:\Users\Admin\AppData\Roaming\1619683555829.exe
"C:\Users\Admin\AppData\Roaming\1619683555829.exe" /sjson "C:\Users\Admin\AppData\Roaming\1619683555829.txt"
9⤵
- Executes dropped EXE
PID:1020

C:\Windows\SysWOW64\cmd.exe
cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\q5Hz0mxRkl.exe"
9⤵
PID:5816

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
10⤵
- Runs ping.exe
PID:5812

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\do4sfvdf.b3l\y1.exe"
8⤵
PID:1816

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:4984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xbpt21ki.h1n\jvppp.exe & exit
6⤵
PID:5708

C:\Users\Admin\AppData\Local\Temp\xbpt21ki.h1n\jvppp.exe
C:\Users\Admin\AppData\Local\Temp\xbpt21ki.h1n\jvppp.exe
7⤵
- Executes dropped EXE
PID:5040

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5304

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5828

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4600

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o2yj2vbm.sb5\GcleanerWW.exe /mixone & exit
6⤵
PID:5936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fgmv45on.xcx\toolspab1.exe & exit
6⤵
PID:6096

C:\Users\Admin\AppData\Local\Temp\fgmv45on.xcx\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\fgmv45on.xcx\toolspab1.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6004

C:\Users\Admin\AppData\Local\Temp\fgmv45on.xcx\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\fgmv45on.xcx\toolspab1.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e3pdgka3.b4l\005.exe & exit
6⤵
PID:4532

C:\Users\Admin\AppData\Local\Temp\e3pdgka3.b4l\005.exe
C:\Users\Admin\AppData\Local\Temp\e3pdgka3.b4l\005.exe
7⤵
- Executes dropped EXE
PID:4604

C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
2⤵
- Executes dropped EXE
PID:508

C:\Users\Admin\AppData\Roaming\1127.tmp.exe
"C:\Users\Admin\AppData\Roaming\1127.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4652

C:\Users\Admin\AppData\Roaming\1127.tmp.exe
"C:\Users\Admin\AppData\Roaming\1127.tmp.exe"
4⤵
- Executes dropped EXE
PID:4512

C:\Users\Admin\AppData\Roaming\1501.tmp.exe
"C:\Users\Admin\AppData\Roaming\1501.tmp.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2912

C:\Windows\system32\msiexec.exe
-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w23650@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
4⤵
PID:5888

C:\Windows\system32\msiexec.exe
-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w20688 --cpu-max-threads-hint 50 -r 9999
4⤵
- Blocklisted process makes network request
PID:4460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\filee.exe"
3⤵
PID:5428

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:4932

C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies registry class
PID:4756

C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
2⤵
- Executes dropped EXE
PID:4932

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:5168

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4504

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:5156

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:5428

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4704

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4964

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1824

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5428

C:\Users\Admin\AppData\Local\Temp\4E5A.exe
C:\Users\Admin\AppData\Local\Temp\4E5A.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5432

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4E5A.exe"
2⤵
PID:4336

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:4904

C:\Users\Admin\AppData\Local\Temp\506F.exe
C:\Users\Admin\AppData\Local\Temp\506F.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
PID:5624

C:\Users\Admin\AppData\Local\Temp\d59faa38-63be-4bd1-9905-b0d8a8623a78\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\d59faa38-63be-4bd1-9905-b0d8a8623a78\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d59faa38-63be-4bd1-9905-b0d8a8623a78\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
- Executes dropped EXE
PID:4440

C:\Users\Admin\AppData\Local\Temp\d59faa38-63be-4bd1-9905-b0d8a8623a78\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\d59faa38-63be-4bd1-9905-b0d8a8623a78\AdvancedRun.exe" /SpecialRun 4101d8 4440
3⤵
- Executes dropped EXE
PID:2924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\506F.exe" -Force
2⤵
PID:5800

C:\Users\Admin\AppData\Local\Temp\506F.exe
"C:\Users\Admin\AppData\Local\Temp\506F.exe"
2⤵
- Executes dropped EXE
PID:5060

C:\Users\Admin\AppData\Local\Temp\567B.exe
C:\Users\Admin\AppData\Local\Temp\567B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5980

C:\Users\Admin\AppData\Local\Temp\567B.exe
"{path}"
2⤵
- Executes dropped EXE
PID:5916

C:\Users\Admin\AppData\Local\Temp\5C86.exe
C:\Users\Admin\AppData\Local\Temp\5C86.exe
1⤵
- Executes dropped EXE
PID:5520

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5208

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4648

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5616

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:5504

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5440

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:4784

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5688

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:6032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5356

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5224

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1652

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

System Information Discovery