redline | b244fb7a7b39c836a9629262eaa80865cfbaf37aaea1b1d4b880d8a864f865a4

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Qz72HteEyn4NExIDuVgJD7js.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Qz72HteEyn4NExIDuVgJD7js.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	arnatic_6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	arnatic_3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	jingzhang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	XpGjubWijQtCOoaIBhe7VcLo.exe

Loads dropped DLL 20 IoCs

pid	Process
3664	setup_install.exe
3664	setup_install.exe
3664	setup_install.exe
3664	setup_install.exe
3664	setup_install.exe
3100	rUNdlL32.eXe
4016	arnatic_2.exe
3428	arnatic_1.exe
3428	arnatic_1.exe
3852	rUNdlL32.eXe
4564	pLI4I2XhoDkykpmcnWXcLLdB.exe
4564	pLI4I2XhoDkykpmcnWXcLLdB.exe
4484	JCFzCY0zoRrSp0gKsHhwdVuD.exe
4484	JCFzCY0zoRrSp0gKsHhwdVuD.exe
5156	chrome.exe
4404	UvsYsaGlyfMT5GG1F37zjCeW.exe
4404	UvsYsaGlyfMT5GG1F37zjCeW.exe
5956	jhswfje
6056	jhswfje
5148	jhswfje

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	1571782.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Qz72HteEyn4NExIDuVgJD7js.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md8_8eus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
163	ipinfo.io
164	ipinfo.io
10	ip-api.com
122	ipinfo.io
135	ipinfo.io
228	ipinfo.io
230	ipinfo.io
48	ipinfo.io
49	ipinfo.io
140	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent E3B1091CC163E4A5	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\nrbux.exe	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Azure-Update-Task	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2408	Qz72HteEyn4NExIDuVgJD7js.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 2684	2144	svchost.exe	97
PID 1300 set thread context of 692	1300	6169268.exe	94
PID 4216 set thread context of 3412	4216	OllWJ7Cj1WADA4uhkFuqf8B8.exe	116
PID 2760 set thread context of 4544	2760	1555874596.exe	124
PID 744 set thread context of 4484	744	JCFzCY0zoRrSp0gKsHhwdVuD.exe	137
PID 1920 set thread context of 4784	1920	1834361517.exe	139
PID 2364 set thread context of 5860	2364	nwmCtHaqp9FwS_BA745oUm0D.exe	177

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral20/files/0x000200000001abbb-311.dat	autoit_exe
behavioral20/files/0x000200000001abbb-312.dat	autoit_exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	SFQ_1ZhjypSq5eUq1dA7f5Hh.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	SFQ_1ZhjypSq5eUq1dA7f5Hh.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\file4.exe	SFQ_1ZhjypSq5eUq1dA7f5Hh.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	SFQ_1ZhjypSq5eUq1dA7f5Hh.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jingzhang.exe	SFQ_1ZhjypSq5eUq1dA7f5Hh.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	SFQ_1ZhjypSq5eUq1dA7f5Hh.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4408	4548	WerFault.exe	142
3976	4548	WerFault.exe	142
2252	4548	WerFault.exe	142
1088	4548	WerFault.exe	142
5416	4548	WerFault.exe	142
5512	4548	WerFault.exe	142
5600	4548	WerFault.exe	142
1140	4548	WerFault.exe	142

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhswfje

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	arnatic_1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pLI4I2XhoDkykpmcnWXcLLdB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	UvsYsaGlyfMT5GG1F37zjCeW.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	UvsYsaGlyfMT5GG1F37zjCeW.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	arnatic_1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pLI4I2XhoDkykpmcnWXcLLdB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JCFzCY0zoRrSp0gKsHhwdVuD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JCFzCY0zoRrSp0gKsHhwdVuD.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2736	schtasks.exe
6044	schtasks.exe
5616	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
1288	timeout.exe
5032	timeout.exe
3744	timeout.exe
4764	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4724	taskkill.exe
3428	taskkill.exe
5452	taskkill.exe
5840	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}	rUNdlL32.eXe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 75cbdf8a116fd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34ABEE	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000002975e50f49231023d3542d4a020cee2ab90293de8dca5e791e6f7b21628d95b2900e274a12f742ad8bf92da76bbec22dca0ca863a04ce0b1340808cd8f61c8a28db0c4bfdaafc51235ef125a27311ebeb5876119732e64445c26	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2304	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3100	rUNdlL32.eXe
3100	rUNdlL32.eXe
2144	svchost.exe
2144	svchost.exe
4016	arnatic_2.exe
4016	arnatic_2.exe
4712	jfiag3g_gg.exe
4712	jfiag3g_gg.exe
4252	3359986.exe
4252	3359986.exe
2764	Process not Found
2764	Process not Found
1300	6169268.exe
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
1300	6169268.exe
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
4372	3639543.exe
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	Process not Found

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4016	arnatic_2.exe
5076	MicrosoftEdgeCP.exe
5076	MicrosoftEdgeCP.exe
5956	jhswfje
6056	jhswfje
5148	jhswfje

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	arnatic_5.exe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	2144	svchost.exe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	3100	rUNdlL32.eXe
Token: SeDebugPrivilege	1300	6169268.exe
Token: SeDebugPrivilege	4372	3639543.exe
Token: SeAssignPrimaryTokenPrivilege	2624	svchost.exe
Token: SeIncreaseQuotaPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeTakeOwnershipPrivilege	2624	svchost.exe
Token: SeLoadDriverPrivilege	2624	svchost.exe
Token: SeSystemtimePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeShutdownPrivilege	2624	svchost.exe
Token: SeSystemEnvironmentPrivilege	2624	svchost.exe
Token: SeUndockPrivilege	2624	svchost.exe
Token: SeManageVolumePrivilege	2624	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2624	svchost.exe
Token: SeIncreaseQuotaPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeTakeOwnershipPrivilege	2624	svchost.exe
Token: SeLoadDriverPrivilege	2624	svchost.exe
Token: SeSystemtimePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeShutdownPrivilege	2624	svchost.exe
Token: SeSystemEnvironmentPrivilege	2624	svchost.exe
Token: SeUndockPrivilege	2624	svchost.exe
Token: SeManageVolumePrivilege	2624	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2624	svchost.exe
Token: SeIncreaseQuotaPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeTakeOwnershipPrivilege	2624	svchost.exe
Token: SeLoadDriverPrivilege	2624	svchost.exe
Token: SeSystemtimePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeShutdownPrivilege	2624	svchost.exe
Token: SeSystemEnvironmentPrivilege	2624	svchost.exe
Token: SeUndockPrivilege	2624	svchost.exe
Token: SeManageVolumePrivilege	2624	svchost.exe
Token: SeDebugPrivilege	692	arnatic_7.exe
Token: SeAssignPrimaryTokenPrivilege	2624	svchost.exe
Token: SeIncreaseQuotaPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeTakeOwnershipPrivilege	2624	svchost.exe
Token: SeLoadDriverPrivilege	2624	svchost.exe
Token: SeSystemtimePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeShutdownPrivilege	2624	svchost.exe
Token: SeSystemEnvironmentPrivilege	2624	svchost.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2764	Process not Found
2764	Process not Found
5156	chrome.exe
5156	chrome.exe
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2764	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2764	Process not Found
4804	MicrosoftEdge.exe
5076	MicrosoftEdgeCP.exe
5076	MicrosoftEdgeCP.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2764	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2680	3424	setup_x86_x64_install - копия (19).exe	76
PID 3424 wrote to memory of 2680	3424	setup_x86_x64_install - копия (19).exe	76
PID 3424 wrote to memory of 2680	3424	setup_x86_x64_install - копия (19).exe	76
PID 2680 wrote to memory of 3664	2680	setup_installer.exe	77
PID 2680 wrote to memory of 3664	2680	setup_installer.exe	77
PID 2680 wrote to memory of 3664	2680	setup_installer.exe	77
PID 3664 wrote to memory of 1984	3664	setup_install.exe	80
PID 3664 wrote to memory of 1984	3664	setup_install.exe	80
PID 3664 wrote to memory of 1984	3664	setup_install.exe	80
PID 3664 wrote to memory of 1276	3664	setup_install.exe	81
PID 3664 wrote to memory of 1276	3664	setup_install.exe	81
PID 3664 wrote to memory of 1276	3664	setup_install.exe	81
PID 3664 wrote to memory of 2596	3664	setup_install.exe	93
PID 3664 wrote to memory of 2596	3664	setup_install.exe	93
PID 3664 wrote to memory of 2596	3664	setup_install.exe	93
PID 3664 wrote to memory of 3112	3664	setup_install.exe	82
PID 3664 wrote to memory of 3112	3664	setup_install.exe	82
PID 3664 wrote to memory of 3112	3664	setup_install.exe	82
PID 3664 wrote to memory of 3632	3664	setup_install.exe	83
PID 3664 wrote to memory of 3632	3664	setup_install.exe	83
PID 3664 wrote to memory of 3632	3664	setup_install.exe	83
PID 3664 wrote to memory of 3564	3664	setup_install.exe	84
PID 3664 wrote to memory of 3564	3664	setup_install.exe	84
PID 3664 wrote to memory of 3564	3664	setup_install.exe	84
PID 3664 wrote to memory of 3668	3664	setup_install.exe	85
PID 3664 wrote to memory of 3668	3664	setup_install.exe	85
PID 3664 wrote to memory of 3668	3664	setup_install.exe	85
PID 1984 wrote to memory of 3428	1984	cmd.exe	86
PID 1984 wrote to memory of 3428	1984	cmd.exe	86
PID 1984 wrote to memory of 3428	1984	cmd.exe	86
PID 3632 wrote to memory of 1296	3632	cmd.exe	87
PID 3632 wrote to memory of 1296	3632	cmd.exe	87
PID 1276 wrote to memory of 4016	1276	cmd.exe	92
PID 1276 wrote to memory of 4016	1276	cmd.exe	92
PID 1276 wrote to memory of 4016	1276	cmd.exe	92
PID 3112 wrote to memory of 2976	3112	cmd.exe	88
PID 3112 wrote to memory of 2976	3112	cmd.exe	88
PID 3112 wrote to memory of 2976	3112	cmd.exe	88
PID 3564 wrote to memory of 3928	3564	cmd.exe	89
PID 3564 wrote to memory of 3928	3564	cmd.exe	89
PID 3564 wrote to memory of 3928	3564	cmd.exe	89
PID 2596 wrote to memory of 1504	2596	cmd.exe	90
PID 2596 wrote to memory of 1504	2596	cmd.exe	90
PID 2596 wrote to memory of 1504	2596	cmd.exe	90
PID 3668 wrote to memory of 1300	3668	cmd.exe	99
PID 3668 wrote to memory of 1300	3668	cmd.exe	99
PID 3668 wrote to memory of 1300	3668	cmd.exe	99
PID 1300 wrote to memory of 692	1300	6169268.exe	94
PID 1300 wrote to memory of 692	1300	6169268.exe	94
PID 1300 wrote to memory of 692	1300	6169268.exe	94
PID 1504 wrote to memory of 3100	1504	arnatic_3.exe	95
PID 1504 wrote to memory of 3100	1504	arnatic_3.exe	95
PID 1504 wrote to memory of 3100	1504	arnatic_3.exe	95
PID 2976 wrote to memory of 1312	2976	arnatic_4.exe	96
PID 2976 wrote to memory of 1312	2976	arnatic_4.exe	96
PID 2976 wrote to memory of 1312	2976	arnatic_4.exe	96
PID 3100 wrote to memory of 2144	3100	rUNdlL32.eXe	69
PID 3100 wrote to memory of 2536	3100	rUNdlL32.eXe	37
PID 2144 wrote to memory of 2684	2144	svchost.exe	97
PID 2144 wrote to memory of 2684	2144	svchost.exe	97
PID 2144 wrote to memory of 2684	2144	svchost.exe	97
PID 3100 wrote to memory of 1008	3100	rUNdlL32.eXe	62
PID 3100 wrote to memory of 2376	3100	rUNdlL32.eXe	18
PID 3100 wrote to memory of 2336	3100	rUNdlL32.eXe	40

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1064

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1368

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2632

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2536

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2336

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1824

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1236

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:964
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:6044
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:5856
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:5968
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Users\Admin\AppData\Roaming\jhswfje
  C:\Users\Admin\AppData\Roaming\jhswfje
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:5956
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:5840
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:192
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:4900
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:6024
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:4772
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:5636
- C:\Users\Admin\AppData\Roaming\jhswfje
  C:\Users\Admin\AppData\Roaming\jhswfje
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:6056
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:5660
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:6136
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:5220
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:652
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:6048
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:4712
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:4288
- C:\Users\Admin\AppData\Roaming\jhswfje
  C:\Users\Admin\AppData\Roaming\jhswfje
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:5148
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  2⤵
  PID:4764

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1008

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (19).exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (19).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_1.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_1.exe
        
        arnatic_1.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3428
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_1.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im arnatic_1.exe /f
        7⤵
        Kills process with taskkill
        
        PID:4724
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:4764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_2.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_2.exe
        
        arnatic_2.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_4.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_4.exe
        
        arnatic_4.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:5140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_5.exe
        
        arnatic_5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
      - C:\Users\Admin\AppData\Roaming\6169268.exe
        
        "C:\Users\Admin\AppData\Roaming\6169268.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1300
      - C:\Users\Admin\AppData\Roaming\1571782.exe
        
        "C:\Users\Admin\AppData\Roaming\1571782.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2140
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:4444
      - C:\Users\Admin\AppData\Roaming\3359986.exe
        
        "C:\Users\Admin\AppData\Roaming\3359986.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4252
      - C:\Users\Admin\AppData\Roaming\3639543.exe
        
        "C:\Users\Admin\AppData\Roaming\3639543.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_6.exe
        
        arnatic_6.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:3928
      - C:\Users\Admin\Documents\OllWJ7Cj1WADA4uhkFuqf8B8.exe
        
        "C:\Users\Admin\Documents\OllWJ7Cj1WADA4uhkFuqf8B8.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4216
        
        C:\Users\Admin\Documents\OllWJ7Cj1WADA4uhkFuqf8B8.exe
        
        C:\Users\Admin\Documents\OllWJ7Cj1WADA4uhkFuqf8B8.exe
        7⤵
        Executes dropped EXE
        
        PID:4232
        
        C:\Users\Admin\Documents\OllWJ7Cj1WADA4uhkFuqf8B8.exe
        
        C:\Users\Admin\Documents\OllWJ7Cj1WADA4uhkFuqf8B8.exe
        7⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Users\Admin\Documents\OllWJ7Cj1WADA4uhkFuqf8B8.exe
        
        C:\Users\Admin\Documents\OllWJ7Cj1WADA4uhkFuqf8B8.exe
        7⤵
        Executes dropped EXE
        
        PID:3412
      - C:\Users\Admin\Documents\JCFzCY0zoRrSp0gKsHhwdVuD.exe
        
        "C:\Users\Admin\Documents\JCFzCY0zoRrSp0gKsHhwdVuD.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:744
        
        C:\Users\Admin\Documents\JCFzCY0zoRrSp0gKsHhwdVuD.exe
        
        C:\Users\Admin\Documents\JCFzCY0zoRrSp0gKsHhwdVuD.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im JCFzCY0zoRrSp0gKsHhwdVuD.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\JCFzCY0zoRrSp0gKsHhwdVuD.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im JCFzCY0zoRrSp0gKsHhwdVuD.exe /f
        9⤵
        Kills process with taskkill
        
        PID:5452
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:5032
      - C:\Users\Admin\Documents\XpGjubWijQtCOoaIBhe7VcLo.exe
        
        "C:\Users\Admin\Documents\XpGjubWijQtCOoaIBhe7VcLo.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\1555874596.exe
        
        C:\Users\Admin\AppData\Local\Temp\1555874596.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\1555874596.exe
        
        C:\Users\Admin\AppData\Local\Temp\1555874596.exe
        8⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\1834361517.exe
        
        C:\Users\Admin\AppData\Local\Temp\1834361517.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\1834361517.exe
        
        C:\Users\Admin\AppData\Local\Temp\1834361517.exe
        8⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\1834361517.exe
        
        C:\Users\Admin\AppData\Local\Temp\1834361517.exe
        8⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\1834361517.exe
        
        C:\Users\Admin\AppData\Local\Temp\1834361517.exe
        8⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\Documents\XpGjubWijQtCOoaIBhe7VcLo.exe & exit
        7⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 0
        8⤵
        Runs ping.exe
        
        PID:2304
      - C:\Users\Admin\Documents\nwmCtHaqp9FwS_BA745oUm0D.exe
        
        "C:\Users\Admin\Documents\nwmCtHaqp9FwS_BA745oUm0D.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2364
        
        C:\Users\Admin\Documents\nwmCtHaqp9FwS_BA745oUm0D.exe
        
        "{path}"
        7⤵
        Executes dropped EXE
        
        PID:5844
        
        C:\Users\Admin\Documents\nwmCtHaqp9FwS_BA745oUm0D.exe
        
        "{path}"
        7⤵
        Executes dropped EXE
        
        PID:5852
        
        C:\Users\Admin\Documents\nwmCtHaqp9FwS_BA745oUm0D.exe
        
        "{path}"
        7⤵
        Executes dropped EXE
        
        PID:5860
      - C:\Users\Admin\Documents\Qz72HteEyn4NExIDuVgJD7js.exe
        
        "C:\Users\Admin\Documents\Qz72HteEyn4NExIDuVgJD7js.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2408
      - C:\Users\Admin\Documents\pLI4I2XhoDkykpmcnWXcLLdB.exe
        
        "C:\Users\Admin\Documents\pLI4I2XhoDkykpmcnWXcLLdB.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im pLI4I2XhoDkykpmcnWXcLLdB.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\pLI4I2XhoDkykpmcnWXcLLdB.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im pLI4I2XhoDkykpmcnWXcLLdB.exe /f
        8⤵
        Kills process with taskkill
        
        PID:3428
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:1288
      - C:\Users\Admin\Documents\SFQ_1ZhjypSq5eUq1dA7f5Hh.exe
        
        "C:\Users\Admin\Documents\SFQ_1ZhjypSq5eUq1dA7f5Hh.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1468
        
        C:\Program Files (x86)\Company\NewProduct\file4.exe
        
        "C:\Program Files (x86)\Company\NewProduct\file4.exe"
        7⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Program Files (x86)\Company\NewProduct\jooyu.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
        7⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        Executes dropped EXE
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        Executes dropped EXE
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:2596
        
        C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:5020
        
        C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
        8⤵
        Loads dropped DLL
        
        PID:3852
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        
        PID:208
      - C:\Users\Admin\Documents\izufVQFkgxuRGRgQ96QTD9DY.exe
        
        "C:\Users\Admin\Documents\izufVQFkgxuRGRgQ96QTD9DY.exe"
        6⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 656
        7⤵
        Program crash
        
        PID:4408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 668
        7⤵
        Program crash
        
        PID:3976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 672
        7⤵
        Program crash
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 796
        7⤵
        Program crash
        
        PID:1088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1052
        7⤵
        Program crash
        
        PID:5416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1260
        7⤵
        Program crash
        
        PID:5512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1300
        7⤵
        Program crash
        
        PID:5600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1320
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:1140
      - C:\Users\Admin\Documents\xqm7o4sCAUzqvaXEfQXI8ZWF.exe
        
        "C:\Users\Admin\Documents\xqm7o4sCAUzqvaXEfQXI8ZWF.exe"
        6⤵
        Executes dropped EXE
        
        PID:6128
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru
        7⤵
        Loads dropped DLL
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        
        PID:5156
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff842814f50,0x7ff842814f60,0x7ff842814f70
        8⤵
        
        PID:5168
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1740 /prefetch:8
        8⤵
        
        PID:5280
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 /prefetch:8
        8⤵
        
        PID:5268
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1692 /prefetch:2
        8⤵
        
        PID:5484
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:1
        8⤵
        
        PID:220
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
        8⤵
        
        PID:4716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
        8⤵
        
        PID:5440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
        8⤵
        
        PID:4484
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
        8⤵
        
        PID:4120
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
        8⤵
        
        PID:4352
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4856 /prefetch:8
        8⤵
        
        PID:5376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
        8⤵
        
        PID:6056
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5664 /prefetch:8
        8⤵
        
        PID:5752
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
        8⤵
        
        PID:2780
        
        C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff67571a890,0x7ff67571a8a0,0x7ff67571a8b0
        9⤵
        
        PID:5592
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5692 /prefetch:8
        8⤵
        
        PID:5824
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5488 /prefetch:8
        8⤵
        
        PID:752
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
        8⤵
        
        PID:5712
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5296 /prefetch:8
        8⤵
        
        PID:5688
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5396 /prefetch:8
        8⤵
        
        PID:5728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5088 /prefetch:8
        8⤵
        
        PID:5376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6136 /prefetch:8
        8⤵
        
        PID:5896
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6248 /prefetch:8
        8⤵
        
        PID:5236
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6244 /prefetch:8
        8⤵
        
        PID:5760
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5588 /prefetch:8
        8⤵
        
        PID:4116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5408 /prefetch:8
        8⤵
        
        PID:3856
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:8
        8⤵
        
        PID:1616
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:8
        8⤵
        
        PID:1116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
        8⤵
        
        PID:4008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4980 /prefetch:8
        8⤵
        
        PID:4708
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4240 /prefetch:8
        8⤵
        
        PID:5664
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
        8⤵
        
        PID:4796
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3728 /prefetch:8
        8⤵
        
        PID:5376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3748 /prefetch:8
        8⤵
        
        PID:216
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5340 /prefetch:8
        8⤵
        
        PID:6124
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3928 /prefetch:8
        8⤵
        
        PID:2404
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4040 /prefetch:8
        8⤵
        
        PID:5072
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5152 /prefetch:8
        8⤵
        
        PID:4456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6476 /prefetch:8
        8⤵
        
        PID:5140
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6416 /prefetch:8
        8⤵
        
        PID:6116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
        8⤵
        
        PID:3104
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3520 /prefetch:8
        8⤵
        
        PID:4320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3572 /prefetch:8
        8⤵
        
        PID:4352
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4020 /prefetch:8
        8⤵
        
        PID:4256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3748 /prefetch:8
        8⤵
        
        PID:3276
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
        8⤵
        
        PID:5636
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4232 /prefetch:8
        8⤵
        
        PID:4736
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4208 /prefetch:8
        8⤵
        
        PID:4176
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:8
        8⤵
        
        PID:4008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6528 /prefetch:8
        8⤵
        
        PID:2692
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6664 /prefetch:8
        8⤵
        
        PID:5692
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6680 /prefetch:8
        8⤵
        
        PID:3828
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6504 /prefetch:8
        8⤵
        
        PID:5116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:8
        8⤵
        
        PID:5236
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6640 /prefetch:8
        8⤵
        
        PID:2948
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
        8⤵
        
        PID:4400
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4068 /prefetch:8
        8⤵
        
        PID:5876
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6824 /prefetch:8
        8⤵
        
        PID:4008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4040 /prefetch:8
        8⤵
        
        PID:3136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,13352169504340010472,10077066424373037735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1972 /prefetch:8
        8⤵
        
        PID:5684
      - C:\Users\Admin\Documents\UvsYsaGlyfMT5GG1F37zjCeW.exe
        
        "C:\Users\Admin\Documents\UvsYsaGlyfMT5GG1F37zjCeW.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im UvsYsaGlyfMT5GG1F37zjCeW.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\UvsYsaGlyfMT5GG1F37zjCeW.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im UvsYsaGlyfMT5GG1F37zjCeW.exe /f
        8⤵
        Kills process with taskkill
        
        PID:5840
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:3744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_7.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_7.exe
        
        arnatic_7.exe
        5⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_7.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2596

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2684

C:\Users\Admin\AppData\Local\Temp\7zS87AE2E14\arnatic_3.exe
arnatic_3.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rUNdlL32.eXe
  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3100

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4804

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1552

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4388

C:\Users\Admin\AppData\Local\Temp\6012.exe
C:\Users\Admin\AppData\Local\Temp\6012.exe
1⤵
- Executes dropped EXE
PID:4584
- C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe
  "C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe"
  2⤵
  - Executes dropped EXE
  PID:5544
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\
    3⤵
    PID:4428
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\
      4⤵
      PID:5824
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nrbux.exe /TR "C:\Users\Admin\AppData\Local\Temp\b67c9bd46f\nrbux.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:5616
- - C:\ProgramData\ac909b1.exe
    "C:\ProgramData\ac909b1.exe"
    3⤵
    - Executes dropped EXE
    PID:5804
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
      4⤵
      Creates scheduled task(s)
      PID:2736

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5832

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery