redline | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	phpbFr9JwWwZQjT8NxkDHIqx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	phpbFr9JwWwZQjT8NxkDHIqx.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	GameBoxWin64.exe

Loads dropped DLL 64 IoCs

pid	Process
1104	8 (15).exe
1948	setup_installer.exe
1948	setup_installer.exe
1948	setup_installer.exe
1948	setup_installer.exe
1948	setup_installer.exe
1948	setup_installer.exe
1480	setup_install.exe
1480	setup_install.exe
1480	setup_install.exe
1480	setup_install.exe
1480	setup_install.exe
1480	setup_install.exe
1480	setup_install.exe
1480	setup_install.exe
836	cmd.exe
836	cmd.exe
408	cmd.exe
1460	cmd.exe
1460	cmd.exe
804	cmd.exe
804	cmd.exe
1536	sonia_2.exe
1536	sonia_2.exe
2032	sonia_3.exe
2032	sonia_3.exe
1660	cmd.exe
1016	cmd.exe
1932	sonia_5.exe
1932	sonia_5.exe
1732	sonia_6.exe
1732	sonia_6.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1536	sonia_2.exe
1640	WerFault.exe
1732	sonia_6.exe
1732	sonia_6.exe
1912	jfiag3g_gg.exe
1912	jfiag3g_gg.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
2156	j0j_XQYZ8zSRsUMslHkWbTfw.exe
2156	j0j_XQYZ8zSRsUMslHkWbTfw.exe
2080	zvcgfarlKSvSkDIaFNPLMAlB.exe
2080	zvcgfarlKSvSkDIaFNPLMAlB.exe
1932	GameBoxWin64.exe
1932	GameBoxWin64.exe
2132	LIZr5BALBjSOT2LPGWlabe5F.exe
2132	LIZr5BALBjSOT2LPGWlabe5F.exe
2264	_CyzwYWlI6osonqDk7vhYwSW.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	phpbFr9JwWwZQjT8NxkDHIqx.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
162	ipinfo.io
254	freegeoip.app
256	freegeoip.app
257	freegeoip.app
261	freegeoip.app
4	ipinfo.io
16	api.db-ip.com
22	ip-api.com
3	ipinfo.io
15	api.db-ip.com
157	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2652	phpbFr9JwWwZQjT8NxkDHIqx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 544	2436	wmiprvse.exe	89

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	UWZRABWcsZhu3C8LRkHHbIwG.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	UWZRABWcsZhu3C8LRkHHbIwG.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	UWZRABWcsZhu3C8LRkHHbIwG.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	UWZRABWcsZhu3C8LRkHHbIwG.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	UWZRABWcsZhu3C8LRkHHbIwG.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1640	1480	WerFault.exe	30
2844	2032	WerFault.exe	39
3048	2908	WerFault.exe	80
2792	2168	WerFault.exe	58
2988	2124	WerFault.exe	104
3192	3040	WerFault.exe	108
364	1128	WerFault.exe	148

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cqN24cllM3Q2jG0RzRGJ5Cv5.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cqN24cllM3Q2jG0RzRGJ5Cv5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	_CyzwYWlI6osonqDk7vhYwSW.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	_CyzwYWlI6osonqDk7vhYwSW.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	_CyzwYWlI6osonqDk7vhYwSW.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cqN24cllM3Q2jG0RzRGJ5Cv5.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3900	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3720	timeout.exe
2036	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
960	taskkill.exe
1932	taskkill.exe
3304	taskkill.exe
3936	taskkill.exe
2004	taskkill.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6712D17C-CEB6-4886-9641-427AF3D488B7}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\9F6We8L3ivezYdjuoJQ_iV57.exe"	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CAD4875-0AB6-4178-9E77-7EFB04692A19}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\9F6We8L3ivezYdjuoJQ_iV57.exe"	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2985A0EF-30E2-4b31-B3B8-8ABA20E3BF97}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\9F6We8L3ivezYdjuoJQ_iV57.exe"	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DEBA2A8-DF1C-40a5-BED4-29F118F80771}	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DEBA2A8-DF1C-40a5-BED4-29F118F80771}\LocalServer32	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DEBA2A8-DF1C-40a5-BED4-29F118F80771}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\9F6We8L3ivezYdjuoJQ_iV57.exe"	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6712D17C-CEB6-4886-9641-427AF3D488B7}	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6712D17C-CEB6-4886-9641-427AF3D488B7}\ = "PotPlayerMini_Enqueue"	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56E1AC5-92D0-4b2a-A8B2-D3E164F540DD}\ = "PotPlayerMCE_Enqueue"	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56E1AC5-92D0-4b2a-A8B2-D3E164F540DD}\LocalServer32	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FFE7772-0EE7-40f4-B7D6-3A44BCF0C42A}\ = "PotPlayerLive_Play"	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FFE7772-0EE7-40f4-B7D6-3A44BCF0C42A}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\9F6We8L3ivezYdjuoJQ_iV57.exe"	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CAD4875-0AB6-4178-9E77-7EFB04692A19}\ = "PotPlayerMini_Play"	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CAD4875-0AB6-4178-9E77-7EFB04692A19}\LocalServer32	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2985A0EF-30E2-4b31-B3B8-8ABA20E3BF97}	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2985A0EF-30E2-4b31-B3B8-8ABA20E3BF97}\LocalServer32	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FFE7772-0EE7-40f4-B7D6-3A44BCF0C42A}	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7CAD4875-0AB6-4178-9E77-7EFB04692A19}	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6712D17C-CEB6-4886-9641-427AF3D488B7}\LocalServer32	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56E1AC5-92D0-4b2a-A8B2-D3E164F540DD}	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\CLSID	9F6We8L3ivezYdjuoJQ_iV57.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FFE7772-0EE7-40f4-B7D6-3A44BCF0C42A}\LocalServer32	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2985A0EF-30E2-4b31-B3B8-8ABA20E3BF97}\ = "PotPlayerMCE_Play"	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1DEBA2A8-DF1C-40a5-BED4-29F118F80771}\ = "PotPlayerLive_Enqueue"	9F6We8L3ivezYdjuoJQ_iV57.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D56E1AC5-92D0-4b2a-A8B2-D3E164F540DD}\LocalServer32\ = "C:\\Users\\Admin\\Documents\\9F6We8L3ivezYdjuoJQ_iV57.exe"	9F6We8L3ivezYdjuoJQ_iV57.exe

Modifies system certificate store 2 TTPs 16 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	sonia_5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	xOAvtlr8mzO171ZPeZdTzQdm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	F1O9jO42sSr5Cd_Cx9iU2qG7.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	sonia_5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	xOAvtlr8mzO171ZPeZdTzQdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	sonia_5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	xOAvtlr8mzO171ZPeZdTzQdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	jooyu.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	jooyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	F1O9jO42sSr5Cd_Cx9iU2qG7.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	sonia_5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	xOAvtlr8mzO171ZPeZdTzQdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	sonia_5.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	161	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	162	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	165	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1536	sonia_2.exe
1536	sonia_2.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
2264	_CyzwYWlI6osonqDk7vhYwSW.exe
2264	_CyzwYWlI6osonqDk7vhYwSW.exe
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1536	sonia_2.exe
2264	_CyzwYWlI6osonqDk7vhYwSW.exe
544	cqN24cllM3Q2jG0RzRGJ5Cv5.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	sonia_4.exe
Token: SeDebugPrivilege	1640	WerFault.exe
Token: SeCreateTokenPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeAssignPrimaryTokenPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeLockMemoryPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeIncreaseQuotaPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeMachineAccountPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeTcbPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeSecurityPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeTakeOwnershipPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeLoadDriverPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeSystemProfilePrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeSystemtimePrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeProfSingleProcessPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeIncBasePriorityPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeCreatePagefilePrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeCreatePermanentPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeBackupPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeRestorePrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeShutdownPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeDebugPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeAuditPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeSystemEnvironmentPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeChangeNotifyPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeRemoteShutdownPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeUndockPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeSyncAgentPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeEnableDelegationPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeManageVolumePrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeImpersonatePrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeCreateGlobalPrivilege	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: 31	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: 32	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: 33	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: 34	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: 35	2168	xOAvtlr8mzO171ZPeZdTzQdm.exe
Token: SeDebugPrivilege	2844	WerFault.exe
Token: SeDebugPrivilege	3048	WerFault.exe
Token: SeShutdownPrivilege	1356	Process not Found
Token: SeShutdownPrivilege	1356	Process not Found
Token: SeShutdownPrivilege	1356	Process not Found
Token: SeShutdownPrivilege	1356	Process not Found
Token: SeShutdownPrivilege	1356	Process not Found
Token: SeShutdownPrivilege	1356	Process not Found
Token: SeShutdownPrivilege	1356	Process not Found
Token: SeCreateTokenPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeAssignPrimaryTokenPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeLockMemoryPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeIncreaseQuotaPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeMachineAccountPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeTcbPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeSecurityPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeTakeOwnershipPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeLoadDriverPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeSystemProfilePrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeSystemtimePrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeProfSingleProcessPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeIncBasePriorityPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeCreatePagefilePrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeCreatePermanentPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeBackupPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeRestorePrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeShutdownPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe
Token: SeDebugPrivilege	2380	ZGdsmreDxgBUALiRFM5oApoy.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found
2956	F1O9jO42sSr5Cd_Cx9iU2qG7.tmp

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1356	Process not Found
1356	Process not Found
1356	Process not Found
1356	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1948	1104	8 (15).exe	26
PID 1104 wrote to memory of 1948	1104	8 (15).exe	26
PID 1104 wrote to memory of 1948	1104	8 (15).exe	26
PID 1104 wrote to memory of 1948	1104	8 (15).exe	26
PID 1104 wrote to memory of 1948	1104	8 (15).exe	26
PID 1104 wrote to memory of 1948	1104	8 (15).exe	26
PID 1104 wrote to memory of 1948	1104	8 (15).exe	26
PID 1948 wrote to memory of 1480	1948	setup_installer.exe	30
PID 1948 wrote to memory of 1480	1948	setup_installer.exe	30
PID 1948 wrote to memory of 1480	1948	setup_installer.exe	30
PID 1948 wrote to memory of 1480	1948	setup_installer.exe	30
PID 1948 wrote to memory of 1480	1948	setup_installer.exe	30
PID 1948 wrote to memory of 1480	1948	setup_installer.exe	30
PID 1948 wrote to memory of 1480	1948	setup_installer.exe	30
PID 1480 wrote to memory of 1460	1480	setup_install.exe	32
PID 1480 wrote to memory of 1460	1480	setup_install.exe	32
PID 1480 wrote to memory of 1460	1480	setup_install.exe	32
PID 1480 wrote to memory of 1460	1480	setup_install.exe	32
PID 1480 wrote to memory of 1460	1480	setup_install.exe	32
PID 1480 wrote to memory of 1460	1480	setup_install.exe	32
PID 1480 wrote to memory of 1460	1480	setup_install.exe	32
PID 1480 wrote to memory of 836	1480	setup_install.exe	33
PID 1480 wrote to memory of 836	1480	setup_install.exe	33
PID 1480 wrote to memory of 836	1480	setup_install.exe	33
PID 1480 wrote to memory of 836	1480	setup_install.exe	33
PID 1480 wrote to memory of 836	1480	setup_install.exe	33
PID 1480 wrote to memory of 836	1480	setup_install.exe	33
PID 1480 wrote to memory of 836	1480	setup_install.exe	33
PID 1480 wrote to memory of 804	1480	setup_install.exe	42
PID 1480 wrote to memory of 804	1480	setup_install.exe	42
PID 1480 wrote to memory of 804	1480	setup_install.exe	42
PID 1480 wrote to memory of 804	1480	setup_install.exe	42
PID 1480 wrote to memory of 804	1480	setup_install.exe	42
PID 1480 wrote to memory of 804	1480	setup_install.exe	42
PID 1480 wrote to memory of 804	1480	setup_install.exe	42
PID 1480 wrote to memory of 408	1480	setup_install.exe	34
PID 1480 wrote to memory of 408	1480	setup_install.exe	34
PID 1480 wrote to memory of 408	1480	setup_install.exe	34
PID 1480 wrote to memory of 408	1480	setup_install.exe	34
PID 1480 wrote to memory of 408	1480	setup_install.exe	34
PID 1480 wrote to memory of 408	1480	setup_install.exe	34
PID 1480 wrote to memory of 408	1480	setup_install.exe	34
PID 1480 wrote to memory of 1016	1480	setup_install.exe	35
PID 1480 wrote to memory of 1016	1480	setup_install.exe	35
PID 1480 wrote to memory of 1016	1480	setup_install.exe	35
PID 1480 wrote to memory of 1016	1480	setup_install.exe	35
PID 1480 wrote to memory of 1016	1480	setup_install.exe	35
PID 1480 wrote to memory of 1016	1480	setup_install.exe	35
PID 1480 wrote to memory of 1016	1480	setup_install.exe	35
PID 1480 wrote to memory of 1660	1480	setup_install.exe	36
PID 1480 wrote to memory of 1660	1480	setup_install.exe	36
PID 1480 wrote to memory of 1660	1480	setup_install.exe	36
PID 1480 wrote to memory of 1660	1480	setup_install.exe	36
PID 1480 wrote to memory of 1660	1480	setup_install.exe	36
PID 1480 wrote to memory of 1660	1480	setup_install.exe	36
PID 1480 wrote to memory of 1660	1480	setup_install.exe	36
PID 1480 wrote to memory of 1252	1480	setup_install.exe	41
PID 1480 wrote to memory of 1252	1480	setup_install.exe	41
PID 1480 wrote to memory of 1252	1480	setup_install.exe	41
PID 1480 wrote to memory of 1252	1480	setup_install.exe	41
PID 1480 wrote to memory of 1252	1480	setup_install.exe	41
PID 1480 wrote to memory of 1252	1480	setup_install.exe	41
PID 1480 wrote to memory of 1252	1480	setup_install.exe	41
PID 836 wrote to memory of 1536	836	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\8 (15).exe
"C:\Users\Admin\AppData\Local\Temp\8 (15).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\7zSC97596C4\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC97596C4\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_1.exe
      4⤵
      Loads dropped DLL
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\7zSC97596C4\sonia_1.exe
        
        sonia_1.exe
        5⤵
        Executes dropped EXE
        
        PID:984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_2.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\7zSC97596C4\sonia_2.exe
        
        sonia_2.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_4.exe
      4⤵
      Loads dropped DLL
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\7zSC97596C4\sonia_4.exe
        
        sonia_4.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_5.exe
      4⤵
      Loads dropped DLL
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\7zSC97596C4\sonia_5.exe
        
        sonia_5.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:1932
      - C:\Users\Admin\Documents\zvcgfarlKSvSkDIaFNPLMAlB.exe
        
        "C:\Users\Admin\Documents\zvcgfarlKSvSkDIaFNPLMAlB.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2080
      - C:\Users\Admin\Documents\wOQ2Fwk9JgmDbyXOJZZX4c4w.exe
        
        "C:\Users\Admin\Documents\wOQ2Fwk9JgmDbyXOJZZX4c4w.exe"
        6⤵
        Executes dropped EXE
        
        PID:2116
      - C:\Users\Admin\Documents\O2rnE1ROF7JYhe6Irk1XmwQS.exe
        
        "C:\Users\Admin\Documents\O2rnE1ROF7JYhe6Irk1XmwQS.exe"
        6⤵
        Executes dropped EXE
        
        PID:2108
      - C:\Users\Admin\Documents\LIZr5BALBjSOT2LPGWlabe5F.exe
        
        "C:\Users\Admin\Documents\LIZr5BALBjSOT2LPGWlabe5F.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2132
      - C:\Users\Admin\Documents\f1h3FMjwiMs1RqiqN_HJftyt.exe
        
        "C:\Users\Admin\Documents\f1h3FMjwiMs1RqiqN_HJftyt.exe"
        6⤵
        Executes dropped EXE
        
        PID:2144
      - C:\Users\Admin\Documents\j0j_XQYZ8zSRsUMslHkWbTfw.exe
        
        "C:\Users\Admin\Documents\j0j_XQYZ8zSRsUMslHkWbTfw.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2156
      - C:\Users\Admin\Documents\xOAvtlr8mzO171ZPeZdTzQdm.exe
        
        "C:\Users\Admin\Documents\xOAvtlr8mzO171ZPeZdTzQdm.exe"
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 1400
        7⤵
        Program crash
        
        PID:2792
      - C:\Users\Admin\Documents\9F6We8L3ivezYdjuoJQ_iV57.exe
        
        "C:\Users\Admin\Documents\9F6We8L3ivezYdjuoJQ_iV57.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        Executes dropped EXE
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:1540
      - C:\Users\Admin\Documents\55JCxyBuJNrBbp5FZTmdiYsG.exe
        
        "C:\Users\Admin\Documents\55JCxyBuJNrBbp5FZTmdiYsG.exe"
        6⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "55JCxyBuJNrBbp5FZTmdiYsG.exe" /f & erase "C:\Users\Admin\Documents\55JCxyBuJNrBbp5FZTmdiYsG.exe" & exit
        7⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "55JCxyBuJNrBbp5FZTmdiYsG.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:3936
      - C:\Users\Admin\Documents\_CyzwYWlI6osonqDk7vhYwSW.exe
        
        "C:\Users\Admin\Documents\_CyzwYWlI6osonqDk7vhYwSW.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2264
      - C:\Users\Admin\Documents\ZGdsmreDxgBUALiRFM5oApoy.exe
        
        "C:\Users\Admin\Documents\ZGdsmreDxgBUALiRFM5oApoy.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
      - C:\Users\Admin\Documents\EYZNaByPTo8dIQfz8qfzWIYK.exe
        
        "C:\Users\Admin\Documents\EYZNaByPTo8dIQfz8qfzWIYK.exe"
        6⤵
        Executes dropped EXE
        
        PID:2452
      - C:\Users\Admin\Documents\cqN24cllM3Q2jG0RzRGJ5Cv5.exe
        
        "C:\Users\Admin\Documents\cqN24cllM3Q2jG0RzRGJ5Cv5.exe"
        6⤵
        
        PID:2436
        
        C:\Users\Admin\Documents\cqN24cllM3Q2jG0RzRGJ5Cv5.exe
        
        "C:\Users\Admin\Documents\cqN24cllM3Q2jG0RzRGJ5Cv5.exe"
        7⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:544
      - C:\Users\Admin\Documents\LkpuGxPARa4VKRfeGFy2TXLp.exe
        
        "C:\Users\Admin\Documents\LkpuGxPARa4VKRfeGFy2TXLp.exe"
        6⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "LkpuGxPARa4VKRfeGFy2TXLp.exe" /f & erase "C:\Users\Admin\Documents\LkpuGxPARa4VKRfeGFy2TXLp.exe" & exit
        7⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "LkpuGxPARa4VKRfeGFy2TXLp.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:1932
      - C:\Users\Admin\Documents\bJayOnmBmqdNDwxFFl78uK6R.exe
        
        "C:\Users\Admin\Documents\bJayOnmBmqdNDwxFFl78uK6R.exe"
        6⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Users\Admin\Documents\bJayOnmBmqdNDwxFFl78uK6R.exe
        
        "{path}"
        7⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im bJayOnmBmqdNDwxFFl78uK6R.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\bJayOnmBmqdNDwxFFl78uK6R.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im bJayOnmBmqdNDwxFFl78uK6R.exe /f
        9⤵
        Kills process with taskkill
        
        PID:2004
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:2036
      - C:\Users\Admin\Documents\ys0lOgVTJLayB4IoLwEKKIfa.exe
        
        "C:\Users\Admin\Documents\ys0lOgVTJLayB4IoLwEKKIfa.exe"
        6⤵
        Executes dropped EXE
        
        PID:2540
      - C:\Users\Admin\Documents\Pcn6UmauV22zTVcKRux7n6Xg.exe
        
        "C:\Users\Admin\Documents\Pcn6UmauV22zTVcKRux7n6Xg.exe"
        6⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Users\Admin\Documents\Pcn6UmauV22zTVcKRux7n6Xg.exe
        
        "C:\Users\Admin\Documents\Pcn6UmauV22zTVcKRux7n6Xg.exe"
        7⤵
        
        PID:2640
      - C:\Users\Admin\Documents\F1O9jO42sSr5Cd_Cx9iU2qG7.exe
        
        "C:\Users\Admin\Documents\F1O9jO42sSr5Cd_Cx9iU2qG7.exe"
        6⤵
        Executes dropped EXE
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\is-G6OTP.tmp\F1O9jO42sSr5Cd_Cx9iU2qG7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G6OTP.tmp\F1O9jO42sSr5Cd_Cx9iU2qG7.tmp" /SL5="$301F2,138429,56832,C:\Users\Admin\Documents\F1O9jO42sSr5Cd_Cx9iU2qG7.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\is-3D1BK.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-3D1BK.tmp\Setup.exe" /Verysilent
        8⤵
        
        PID:2864
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe" /Silent
        9⤵
        
        PID:2140
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"
        9⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:3420
        
        C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
        9⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 276
        10⤵
        Program crash
        
        PID:2988
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"
        9⤵
        Checks computer location settings
        Loads dropped DLL
        
        PID:1932
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"
        10⤵
        
        PID:1908
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
        9⤵
        
        PID:3036
        
        C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"
        9⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 960
        10⤵
        Program crash
        
        PID:3192
        
        C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
        
        "C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"
        9⤵
        
        PID:1060
      - C:\Users\Admin\Documents\FbXG0NuIqrYCUnYefUxik9sS.exe
        
        "C:\Users\Admin\Documents\FbXG0NuIqrYCUnYefUxik9sS.exe"
        6⤵
        Executes dropped EXE
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im FbXG0NuIqrYCUnYefUxik9sS.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\FbXG0NuIqrYCUnYefUxik9sS.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im FbXG0NuIqrYCUnYefUxik9sS.exe /f
        8⤵
        Kills process with taskkill
        
        PID:3304
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:3720
      - C:\Users\Admin\Documents\phpbFr9JwWwZQjT8NxkDHIqx.exe
        
        "C:\Users\Admin\Documents\phpbFr9JwWwZQjT8NxkDHIqx.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2652
      - C:\Users\Admin\Documents\ozUvuNZsGTKDypArn93hYr_A.exe
        
        "C:\Users\Admin\Documents\ozUvuNZsGTKDypArn93hYr_A.exe"
        6⤵
        Executes dropped EXE
        
        PID:2632
      - C:\Users\Admin\Documents\UWZRABWcsZhu3C8LRkHHbIwG.exe
        
        "C:\Users\Admin\Documents\UWZRABWcsZhu3C8LRkHHbIwG.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2624
        
        C:\Program Files (x86)\Company\NewProduct\customer3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
        7⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:3128
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 276
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
        
        C:\Program Files (x86)\Company\NewProduct\jooyu.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        Executes dropped EXE
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3256
      - C:\Users\Admin\Documents\lRxMXjf_m1CNKmqH1td9udG5.exe
        
        "C:\Users\Admin\Documents\lRxMXjf_m1CNKmqH1td9udG5.exe"
        6⤵
        Executes dropped EXE
        
        PID:2616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_6.exe
      4⤵
      Loads dropped DLL
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\7zSC97596C4\sonia_6.exe
        
        sonia_6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_7.exe
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_3.exe
      4⤵
      Loads dropped DLL
      PID:804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 412
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1640

C:\Users\Admin\AppData\Local\Temp\7zSC97596C4\sonia_3.exe
sonia_3.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 964
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2844

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2436

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
PID:2564

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
PID:1504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:2
  2⤵
  PID:2000

C:\Users\Admin\AppData\Local\Temp\55BE.exe
C:\Users\Admin\AppData\Local\Temp\55BE.exe
1⤵
PID:3444

C:\Windows\system32\taskeng.exe
taskeng.exe {62AE3FD0-B55E-4299-8271-5BDA132FAA97} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
PID:2504
- C:\Users\Admin\AppData\Roaming\jiibvvc
  C:\Users\Admin\AppData\Roaming\jiibvvc
  2⤵
  PID:3432
- - C:\Users\Admin\AppData\Roaming\jiibvvc
    C:\Users\Admin\AppData\Roaming\jiibvvc
    3⤵
    PID:1532
- C:\Users\Admin\AppData\Roaming\vdibvvc
  C:\Users\Admin\AppData\Roaming\vdibvvc
  2⤵
  PID:3420
- C:\Users\Admin\AppData\Roaming\vdibvvc
  C:\Users\Admin\AppData\Roaming\vdibvvc
  2⤵
  PID:3660
- C:\Users\Admin\AppData\Roaming\jiibvvc
  C:\Users\Admin\AppData\Roaming\jiibvvc
  2⤵
  PID:608
- - C:\Users\Admin\AppData\Roaming\jiibvvc
    C:\Users\Admin\AppData\Roaming\jiibvvc
    3⤵
    PID:3800
- C:\Users\Admin\AppData\Roaming\jiibvvc
  C:\Users\Admin\AppData\Roaming\jiibvvc
  2⤵
  PID:3956
- C:\Users\Admin\AppData\Roaming\vdibvvc
  C:\Users\Admin\AppData\Roaming\vdibvvc
  2⤵
  PID:1352

C:\Users\Admin\AppData\Local\Temp\3045.exe
C:\Users\Admin\AppData\Local\Temp\3045.exe
1⤵
PID:2272

C:\Users\Admin\AppData\Local\Temp\1B7F.exe
C:\Users\Admin\AppData\Local\Temp\1B7F.exe
1⤵
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 900
  2⤵
  - Program crash
  PID:364

C:\Users\Admin\AppData\Local\Temp\7800.exe
C:\Users\Admin\AppData\Local\Temp\7800.exe
1⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\F74E.exe
C:\Users\Admin\AppData\Local\Temp\F74E.exe
1⤵
PID:2636
- C:\Program Files\Windows Defender\MpCmdRun.exe
  "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All -Set-Mp Preference -DisableIOAVProtection $True -DisableRealtimeMonitoring $True -Force
  2⤵
  PID:3080
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /ED "12/12/2022" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:3900
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  PID:3508
- - C:\Program Files\Windows Defender\MpCmdRun.exe
    "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All -Set-Mp Preference -DisableIOAVProtection $True -DisableRealtimeMonitoring $True -Force
    3⤵
    PID:2612
- - C:\Windows\System\spoolsv.exe
    "C:\Windows\System\spoolsv.exe" --MaxCircuitDirtiness 60 --NewCircuitPeriod 1 --MaxClientCircuitsPending 1024 --OptimisticData 1 --KeepalivePeriod 30 --CircuitBuildTimeout 10 --EnforceDistinctSubnets 0 --HardwareAccel 1 --UseEntryGuards 0
    3⤵
    PID:2148

C:\Users\Admin\AppData\Local\Temp\9EA5.exe
C:\Users\Admin\AppData\Local\Temp\9EA5.exe
1⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\4244.exe
C:\Users\Admin\AppData\Local\Temp\4244.exe
1⤵
PID:3180

C:\Users\Admin\AppData\Local\Temp\601.exe
C:\Users\Admin\AppData\Local\Temp\601.exe
1⤵
PID:2568

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3664

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2184

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1912

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3724

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3404

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2276

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3524

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3476

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3740

C:\Windows\system32\taskeng.exe
taskeng.exe {A5E8901D-1F40-49CC-B5A8-993105F36EB1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1756
- \??\c:\windows\system\svchost.exe
  c:\windows\system\svchost.exe
  2⤵
  PID:4088
- \??\c:\windows\system\svchost.exe
  c:\windows\system\svchost.exe
  2⤵
  PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery