glupteba | 41ce43aa875bf977ec9eb039e5853ade1af522dd0dff4f19282f6c8038ae2dff

System Information Discovery

Processes:

5EC5B50B93521F0C90686EF036FFF786.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	5EC5B50B93521F0C90686EF036FFF786.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2324 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2324	rundll32.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\fY9qDGpvv5EmESbqEQLyQspX.exe	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

Files.exe7382772.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.ex"	Files.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	7382772.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

275 ipinfo.io
286 ipinfo.io
11 ip-api.com
39 ipinfo.io
44 ipinfo.io
63 ipinfo.io
Suspicious use of SetThreadContext 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 1268 set thread context of 4880 1268 svchost.exe svchost.exe

flow	ioc
275	ipinfo.io
286	ipinfo.io
11	ip-api.com
39	ipinfo.io
44	ipinfo.io
63	ipinfo.io

description	pid	process	target process
PID 1268 set thread context of 4880	1268	svchost.exe	svchost.exe

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\mysetold.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\mysetold.exe	autoit_exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4728	3520	WerFault.exe	7661704.exe
5540	2064	WerFault.exe	7077425.exe
2480	5860	WerFault.exe	hfN3RQSOPbpNiJigRLibUTvF.exe
8120	7840	WerFault.exe	TkXPNfzogiHgR5wFIing05OI.exe
6016	7840	WerFault.exe	TkXPNfzogiHgR5wFIing05OI.exe
5064	7840	WerFault.exe	TkXPNfzogiHgR5wFIing05OI.exe
5216	7840	WerFault.exe	TkXPNfzogiHgR5wFIing05OI.exe
3296	7840	WerFault.exe	TkXPNfzogiHgR5wFIing05OI.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

pub2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

7560 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5148 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4596 taskkill.exe

pid	process
7560	schtasks.exe

pid	process
5148	timeout.exe

pid	process
4596	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exerundll32.exesvchost.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{C1E5D28C-50F6-4E47-B2C3-F24B885AD1A3}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74WP1CM3-506M-V62R-WR42-7MQP227Y2YLP}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "4712"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000466f16f7f0e8435ee8e70daaf3a6686bee351e7f0425dc2ab5837668a3e3dacccf4f03695b67b995b60c79b4ea1f1c40a5eff9c3a1e64e05cfc2	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "30"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{20DF1156-A8C7-4228-97F4-C0D4D425CB05} = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = eab00dfdaf90d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Install.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Install.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	283	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	295	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 63 IoCs

Processes:

rUNdlL32.eXepub2.exe7661704.exerundll32.exesvchost.exeWerFault.exeInstallation.exe

pid	process
4372	rUNdlL32.eXe
4372	rUNdlL32.eXe
4772	pub2.exe
4772	pub2.exe
3520	7661704.exe
3520	7661704.exe
2324	rundll32.exe
2324	rundll32.exe
1268	svchost.exe
1268	svchost.exe
2180
2180
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
4728	WerFault.exe
2180
2180
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4728	WerFault.exe
4728	WerFault.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
2180
2180
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe
4708	Installation.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pub2.exe

pid process

4772 pub2.exe

pid	process
4772	pub2.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

KRSetp.exe7661704.exeMicrosoftEdge.exe7077425.exeInstall.exe1808086.exerundll32.exesvchost.exeWerFault.exesvchost.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	192	KRSetp.exe
Token: SeDebugPrivilege	3520	7661704.exe
Token: SeDebugPrivilege	2068	MicrosoftEdge.exe
Token: SeDebugPrivilege	2068	MicrosoftEdge.exe
Token: SeDebugPrivilege	2068	MicrosoftEdge.exe
Token: SeDebugPrivilege	2068	MicrosoftEdge.exe
Token: SeDebugPrivilege	2064	7077425.exe
Token: SeCreateTokenPrivilege	4476	Install.exe
Token: SeAssignPrimaryTokenPrivilege	4476	Install.exe
Token: SeLockMemoryPrivilege	4476	Install.exe
Token: SeIncreaseQuotaPrivilege	4476	Install.exe
Token: SeMachineAccountPrivilege	4476	Install.exe
Token: SeTcbPrivilege	4476	Install.exe
Token: SeSecurityPrivilege	4476	Install.exe
Token: SeTakeOwnershipPrivilege	4476	Install.exe
Token: SeLoadDriverPrivilege	4476	Install.exe
Token: SeSystemProfilePrivilege	4476	Install.exe
Token: SeSystemtimePrivilege	4476	Install.exe
Token: SeProfSingleProcessPrivilege	4476	Install.exe
Token: SeIncBasePriorityPrivilege	4476	Install.exe
Token: SeCreatePagefilePrivilege	4476	Install.exe
Token: SeCreatePermanentPrivilege	4476	Install.exe
Token: SeBackupPrivilege	4476	Install.exe
Token: SeRestorePrivilege	4476	Install.exe
Token: SeShutdownPrivilege	4476	Install.exe
Token: SeDebugPrivilege	4476	Install.exe
Token: SeAuditPrivilege	4476	Install.exe
Token: SeSystemEnvironmentPrivilege	4476	Install.exe
Token: SeChangeNotifyPrivilege	4476	Install.exe
Token: SeRemoteShutdownPrivilege	4476	Install.exe
Token: SeUndockPrivilege	4476	Install.exe
Token: SeSyncAgentPrivilege	4476	Install.exe
Token: SeEnableDelegationPrivilege	4476	Install.exe
Token: SeManageVolumePrivilege	4476	Install.exe
Token: SeImpersonatePrivilege	4476	Install.exe
Token: SeCreateGlobalPrivilege	4476	Install.exe
Token: 31	4476	Install.exe
Token: 32	4476	Install.exe
Token: 33	4476	Install.exe
Token: 34	4476	Install.exe
Token: 35	4476	Install.exe
Token: SeDebugPrivilege	492	1808086.exe
Token: SeDebugPrivilege	2324	rundll32.exe
Token: SeDebugPrivilege	1268	svchost.exe
Token: SeDebugPrivilege	2324	rundll32.exe
Token: SeDebugPrivilege	2324	rundll32.exe
Token: SeDebugPrivilege	2324	rundll32.exe
Token: SeDebugPrivilege	2324	rundll32.exe
Token: SeDebugPrivilege	2324	rundll32.exe
Token: SeDebugPrivilege	4728	WerFault.exe
Token: SeDebugPrivilege	2324	rundll32.exe
Token: SeAuditPrivilege	2460	svchost.exe
Token: SeDebugPrivilege	4596	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2324	rundll32.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

mysetold.exe

pid process

4804 mysetold.exe
4804 mysetold.exe
4804 mysetold.exe
4804 mysetold.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

mysetold.exe

pid process

4804 mysetold.exe
4804 mysetold.exe
4804 mysetold.exe
4804 mysetold.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeInstallation.exeMicrosoftEdgeCP.exeComplete.exe

pid process

2068 MicrosoftEdge.exe
4708 Installation.exe
4456 MicrosoftEdgeCP.exe
4884 Complete.exe

pid	process
4804	mysetold.exe
4804	mysetold.exe
4804	mysetold.exe
4804	mysetold.exe

pid	process
4804	mysetold.exe
4804	mysetold.exe
4804	mysetold.exe
4804	mysetold.exe

pid	process
2068	MicrosoftEdge.exe
4708	Installation.exe
4456	MicrosoftEdgeCP.exe
4884	Complete.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5EC5B50B93521F0C90686EF036FFF786.exeFiles.exeKRSetp.exe7382772.exeFolder.exeInstall.exerUNdlL32.eXecmd.exerundll32.exesvchost.exe

description	pid	process	target process
PID 1096 wrote to memory of 2876	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Files.exe
PID 1096 wrote to memory of 2876	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Files.exe
PID 1096 wrote to memory of 2876	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Files.exe
PID 1096 wrote to memory of 192	1096	5EC5B50B93521F0C90686EF036FFF786.exe	KRSetp.exe
PID 1096 wrote to memory of 192	1096	5EC5B50B93521F0C90686EF036FFF786.exe	KRSetp.exe
PID 2876 wrote to memory of 1308	2876	Files.exe	jfiag3g_gg.exe
PID 2876 wrote to memory of 1308	2876	Files.exe	jfiag3g_gg.exe
PID 2876 wrote to memory of 1308	2876	Files.exe	jfiag3g_gg.exe
PID 192 wrote to memory of 3520	192	KRSetp.exe	7661704.exe
PID 192 wrote to memory of 3520	192	KRSetp.exe	7661704.exe
PID 192 wrote to memory of 2140	192	KRSetp.exe	7382772.exe
PID 192 wrote to memory of 2140	192	KRSetp.exe	7382772.exe
PID 192 wrote to memory of 2140	192	KRSetp.exe	7382772.exe
PID 192 wrote to memory of 492	192	KRSetp.exe	1808086.exe
PID 192 wrote to memory of 492	192	KRSetp.exe	1808086.exe
PID 192 wrote to memory of 492	192	KRSetp.exe	1808086.exe
PID 192 wrote to memory of 2064	192	KRSetp.exe	7077425.exe
PID 192 wrote to memory of 2064	192	KRSetp.exe	7077425.exe
PID 192 wrote to memory of 2064	192	KRSetp.exe	7077425.exe
PID 2140 wrote to memory of 4232	2140	7382772.exe	WinHoster.exe
PID 2140 wrote to memory of 4232	2140	7382772.exe	WinHoster.exe
PID 2140 wrote to memory of 4232	2140	7382772.exe	WinHoster.exe
PID 2876 wrote to memory of 4372	2876	Files.exe	rUNdlL32.eXe
PID 2876 wrote to memory of 4372	2876	Files.exe	rUNdlL32.eXe
PID 2876 wrote to memory of 4372	2876	Files.exe	rUNdlL32.eXe
PID 1096 wrote to memory of 4476	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Install.exe
PID 1096 wrote to memory of 4476	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Install.exe
PID 1096 wrote to memory of 4476	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Install.exe
PID 1096 wrote to memory of 4560	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Folder.exe
PID 1096 wrote to memory of 4560	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Folder.exe
PID 1096 wrote to memory of 4560	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Folder.exe
PID 1096 wrote to memory of 4656	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Info.exe
PID 1096 wrote to memory of 4656	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Info.exe
PID 1096 wrote to memory of 4656	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Info.exe
PID 1096 wrote to memory of 4708	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Installation.exe
PID 1096 wrote to memory of 4708	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Installation.exe
PID 1096 wrote to memory of 4708	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Installation.exe
PID 1096 wrote to memory of 4772	1096	5EC5B50B93521F0C90686EF036FFF786.exe	pub2.exe
PID 1096 wrote to memory of 4772	1096	5EC5B50B93521F0C90686EF036FFF786.exe	pub2.exe
PID 1096 wrote to memory of 4772	1096	5EC5B50B93521F0C90686EF036FFF786.exe	pub2.exe
PID 1096 wrote to memory of 4804	1096	5EC5B50B93521F0C90686EF036FFF786.exe	mysetold.exe
PID 1096 wrote to memory of 4804	1096	5EC5B50B93521F0C90686EF036FFF786.exe	mysetold.exe
PID 1096 wrote to memory of 4804	1096	5EC5B50B93521F0C90686EF036FFF786.exe	mysetold.exe
PID 1096 wrote to memory of 4832	1096	5EC5B50B93521F0C90686EF036FFF786.exe	md9_1sjm.exe
PID 1096 wrote to memory of 4832	1096	5EC5B50B93521F0C90686EF036FFF786.exe	md9_1sjm.exe
PID 1096 wrote to memory of 4832	1096	5EC5B50B93521F0C90686EF036FFF786.exe	md9_1sjm.exe
PID 1096 wrote to memory of 4884	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Complete.exe
PID 1096 wrote to memory of 4884	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Complete.exe
PID 1096 wrote to memory of 4884	1096	5EC5B50B93521F0C90686EF036FFF786.exe	Complete.exe
PID 4560 wrote to memory of 4896	4560	Folder.exe	Folder.exe
PID 4560 wrote to memory of 4896	4560	Folder.exe	Folder.exe
PID 4560 wrote to memory of 4896	4560	Folder.exe	Folder.exe
PID 4476 wrote to memory of 804	4476	Install.exe	cmd.exe
PID 4476 wrote to memory of 804	4476	Install.exe	cmd.exe
PID 4476 wrote to memory of 804	4476	Install.exe	cmd.exe
PID 4372 wrote to memory of 2324	4372	rUNdlL32.eXe	rundll32.exe
PID 4372 wrote to memory of 2324	4372	rUNdlL32.eXe	rundll32.exe
PID 4372 wrote to memory of 2324	4372	rUNdlL32.eXe	rundll32.exe
PID 804 wrote to memory of 4596	804	cmd.exe	MicrosoftEdgeCP.exe
PID 804 wrote to memory of 4596	804	cmd.exe	MicrosoftEdgeCP.exe
PID 804 wrote to memory of 4596	804	cmd.exe	MicrosoftEdgeCP.exe
PID 2324 wrote to memory of 1268	2324	rundll32.exe	svchost.exe
PID 2324 wrote to memory of 2892	2324	rundll32.exe	svchost.exe
PID 1268 wrote to memory of 4880	1268	svchost.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2892

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1056

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:912

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:340

C:\Users\Admin\AppData\Local\Temp\5EC5B50B93521F0C90686EF036FFF786.exe
"C:\Users\Admin\AppData\Local\Temp\5EC5B50B93521F0C90686EF036FFF786.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Local\Temp\Files.exe
"C:\Users\Admin\AppData\Local\Temp\Files.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:1308

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:4372

C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:192

C:\Users\Admin\AppData\Roaming\7661704.exe
"C:\Users\Admin\AppData\Roaming\7661704.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3520 -s 1932
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Users\Admin\AppData\Roaming\7382772.exe
"C:\Users\Admin\AppData\Roaming\7382772.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
- Executes dropped EXE
PID:4232

C:\Users\Admin\AppData\Roaming\1808086.exe
"C:\Users\Admin\AppData\Roaming\1808086.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:492

C:\Users\Admin\AppData\Roaming\7077425.exe
"C:\Users\Admin\AppData\Roaming\7077425.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 1980
4⤵
- Program crash
PID:5540

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
4⤵
- Kills process with taskkill
PID:4596

C:\Users\Admin\AppData\Local\Temp\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\Folder.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560

C:\Users\Admin\AppData\Local\Temp\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
3⤵
- Executes dropped EXE
PID:4896

C:\Users\Admin\AppData\Local\Temp\Info.exe
"C:\Users\Admin\AppData\Local\Temp\Info.exe"
2⤵
- Executes dropped EXE
PID:4656

C:\Users\Admin\AppData\Local\Temp\Installation.exe
"C:\Users\Admin\AppData\Local\Temp\Installation.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Users\Admin\Documents\ytxNJf66Rt8WgCtwjdu41SUp.exe
"C:\Users\Admin\Documents\ytxNJf66Rt8WgCtwjdu41SUp.exe"
3⤵
PID:5912

C:\Users\Admin\AppData\Roaming\7926263.exe
"C:\Users\Admin\AppData\Roaming\7926263.exe"
4⤵
PID:6844

C:\Users\Admin\AppData\Roaming\5308965.exe
"C:\Users\Admin\AppData\Roaming\5308965.exe"
4⤵
PID:6920

C:\Users\Admin\Documents\Y0wvA41RxU9VCEyByf8iIE2X.exe
"C:\Users\Admin\Documents\Y0wvA41RxU9VCEyByf8iIE2X.exe"
3⤵
PID:5872

C:\Users\Admin\Documents\hfN3RQSOPbpNiJigRLibUTvF.exe
"C:\Users\Admin\Documents\hfN3RQSOPbpNiJigRLibUTvF.exe"
3⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 480
4⤵
- Program crash
PID:2480

C:\Users\Admin\Documents\fY9qDGpvv5EmESbqEQLyQspX.exe
"C:\Users\Admin\Documents\fY9qDGpvv5EmESbqEQLyQspX.exe"
3⤵
PID:5848

C:\Users\Admin\Documents\PAm6_lHYm8lvQLhpENll0DyD.exe
"C:\Users\Admin\Documents\PAm6_lHYm8lvQLhpENll0DyD.exe"
3⤵
PID:5836

C:\Users\Admin\Documents\PAm6_lHYm8lvQLhpENll0DyD.exe
"C:\Users\Admin\Documents\PAm6_lHYm8lvQLhpENll0DyD.exe"
4⤵
PID:4944

C:\Users\Admin\Documents\VwbLYd9IvG9pJjuli0NiZ5JF.exe
"C:\Users\Admin\Documents\VwbLYd9IvG9pJjuli0NiZ5JF.exe"
3⤵
PID:5820

C:\Users\Admin\Documents\VwbLYd9IvG9pJjuli0NiZ5JF.exe
C:\Users\Admin\Documents\VwbLYd9IvG9pJjuli0NiZ5JF.exe
4⤵
PID:2112

C:\Users\Admin\Documents\WfWOWxjV1UaFvLUxhLbJnk3F.exe
"C:\Users\Admin\Documents\WfWOWxjV1UaFvLUxhLbJnk3F.exe"
3⤵
PID:5812

C:\Users\Admin\Documents\WfWOWxjV1UaFvLUxhLbJnk3F.exe
C:\Users\Admin\Documents\WfWOWxjV1UaFvLUxhLbJnk3F.exe
4⤵
PID:5564

C:\Users\Admin\Documents\8nLJo7eFCw_1KPhe4BdJguHT.exe
"C:\Users\Admin\Documents\8nLJo7eFCw_1KPhe4BdJguHT.exe"
3⤵
PID:5796

C:\Users\Admin\Documents\ACYxud1FNlTcT45Eqh30B_ed.exe
"C:\Users\Admin\Documents\ACYxud1FNlTcT45Eqh30B_ed.exe"
3⤵
PID:5788

C:\Users\Admin\Documents\pW0JlwdYXUtAYYNBestK1Iz8.exe
"C:\Users\Admin\Documents\pW0JlwdYXUtAYYNBestK1Iz8.exe"
3⤵
PID:5772

C:\Users\Admin\Documents\1kunpS5FnQa5eTT3ZTs39hSd.exe
"C:\Users\Admin\Documents\1kunpS5FnQa5eTT3ZTs39hSd.exe"
3⤵
PID:5440

C:\Users\Admin\Documents\uqj42fOCtL_qOT3krLnd2zDs.exe
"C:\Users\Admin\Documents\uqj42fOCtL_qOT3krLnd2zDs.exe"
3⤵
PID:4540

C:\Users\Admin\Documents\uqj42fOCtL_qOT3krLnd2zDs.exe
"{path}"
4⤵
PID:4148

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
5⤵
- Creates scheduled task(s)
PID:7560

C:\Users\Admin\Documents\FRR6fqad35Lbrea2PnTNYPhd.exe
"C:\Users\Admin\Documents\FRR6fqad35Lbrea2PnTNYPhd.exe"
3⤵
PID:6132

C:\Users\Admin\AppData\Roaming\4776891.exe
"C:\Users\Admin\AppData\Roaming\4776891.exe"
4⤵
PID:6816

C:\Users\Admin\AppData\Roaming\6617927.exe
"C:\Users\Admin\AppData\Roaming\6617927.exe"
4⤵
PID:6908

C:\Users\Admin\Documents\FJF0dKpvvynFZ6mJm90CxRTb.exe
"C:\Users\Admin\Documents\FJF0dKpvvynFZ6mJm90CxRTb.exe"
3⤵
PID:4220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshAF6D.tmp\tempfile.ps1"
4⤵
PID:5876

C:\Users\Admin\Documents\c2tCiOllqF0PITme4rVFRbzH.exe
"C:\Users\Admin\Documents\c2tCiOllqF0PITme4rVFRbzH.exe"
3⤵
PID:5668

C:\Users\Admin\Documents\7mGTQxeHCGK0QsBQ0MxCOyOW.exe
"C:\Users\Admin\Documents\7mGTQxeHCGK0QsBQ0MxCOyOW.exe"
3⤵
PID:5560

C:\Users\Admin\Documents\HznUErTnHBszLIMXPuorDpqa.exe
"C:\Users\Admin\Documents\HznUErTnHBszLIMXPuorDpqa.exe"
3⤵
PID:1620

C:\Users\Admin\Documents\HznUErTnHBszLIMXPuorDpqa.exe
C:\Users\Admin\Documents\HznUErTnHBszLIMXPuorDpqa.exe
4⤵
PID:6692

C:\Users\Admin\Documents\m8bnJIgk4plR7zBjU9cGi7VY.exe
"C:\Users\Admin\Documents\m8bnJIgk4plR7zBjU9cGi7VY.exe"
3⤵
PID:5028

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:4872

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:6856

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:6420

C:\Users\Admin\Documents\5HiBlWskfMOLfzShcxrm1fMF.exe
"C:\Users\Admin\Documents\5HiBlWskfMOLfzShcxrm1fMF.exe"
3⤵
PID:5900

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
4⤵
PID:732

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:6308

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
5⤵
PID:5832

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:7292

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
PID:7396

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:8140

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
PID:7328

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:7108

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
5⤵
PID:7408

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
4⤵
PID:1220

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
4⤵
PID:6152

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:6640

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:2200

C:\Users\Admin\Documents\m9823t8FoDRb322lJPdhDMmx.exe
"C:\Users\Admin\Documents\m9823t8FoDRb322lJPdhDMmx.exe"
3⤵
PID:5092

C:\Users\Admin\Documents\FsOBDAj9gi_ChF7SiDVZkrlf.exe
"C:\Users\Admin\Documents\FsOBDAj9gi_ChF7SiDVZkrlf.exe"
3⤵
PID:1388

C:\Users\Admin\AppData\Roaming\5754091.exe
"C:\Users\Admin\AppData\Roaming\5754091.exe"
4⤵
PID:6888

C:\Users\Admin\AppData\Roaming\8598115.exe
"C:\Users\Admin\AppData\Roaming\8598115.exe"
4⤵
PID:7028

C:\Users\Admin\AppData\Roaming\7899847.exe
"C:\Users\Admin\AppData\Roaming\7899847.exe"
4⤵
PID:6832

C:\Users\Admin\AppData\Roaming\2578303.exe
"C:\Users\Admin\AppData\Roaming\2578303.exe"
4⤵
PID:7132

C:\Users\Admin\Documents\maQKHU9UGdEtELimcIY8rcqP.exe
"C:\Users\Admin\Documents\maQKHU9UGdEtELimcIY8rcqP.exe"
3⤵
PID:1008

C:\Users\Admin\Documents\EkVffAItHFAWTwEaA0G_VDPs.exe
"C:\Users\Admin\Documents\EkVffAItHFAWTwEaA0G_VDPs.exe"
3⤵
PID:6448

C:\Users\Admin\AppData\Local\Temp\is-P6U9A.tmp\EkVffAItHFAWTwEaA0G_VDPs.tmp
"C:\Users\Admin\AppData\Local\Temp\is-P6U9A.tmp\EkVffAItHFAWTwEaA0G_VDPs.tmp" /SL5="$30302,138429,56832,C:\Users\Admin\Documents\EkVffAItHFAWTwEaA0G_VDPs.exe"
4⤵
PID:7016

C:\Users\Admin\AppData\Local\Temp\pub2.exe
"C:\Users\Admin\AppData\Local\Temp\pub2.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4772

C:\Users\Admin\AppData\Local\Temp\mysetold.exe
"C:\Users\Admin\AppData\Local\Temp\mysetold.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4804

C:\Users\Public\run.exe
C:\Users\Public\run.exe
3⤵
PID:2856

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\run.exe"
4⤵
PID:5312

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
5⤵
- Delays execution with timeout.exe
PID:5148

C:\Users\Public\run2.exe
C:\Users\Public\run2.exe
3⤵
PID:5156

C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe
"C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe"
4⤵
PID:1228

C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
"C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"
2⤵
- Executes dropped EXE
PID:4832

C:\Users\Admin\AppData\Local\Temp\Complete.exe
"C:\Users\Admin\AppData\Local\Temp\Complete.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4884

C:\Users\Admin\Documents\d9ImC0ToJws_fe05eWKp683c.exe
"C:\Users\Admin\Documents\d9ImC0ToJws_fe05eWKp683c.exe"
3⤵
PID:6444

C:\Users\Admin\AppData\Roaming\1884050.exe
"C:\Users\Admin\AppData\Roaming\1884050.exe"
4⤵
PID:6388

C:\Users\Admin\AppData\Roaming\6124610.exe
"C:\Users\Admin\AppData\Roaming\6124610.exe"
4⤵
PID:4212

C:\Users\Admin\AppData\Roaming\5679484.exe
"C:\Users\Admin\AppData\Roaming\5679484.exe"
4⤵
PID:5304

C:\Users\Admin\AppData\Roaming\4536716.exe
"C:\Users\Admin\AppData\Roaming\4536716.exe"
4⤵
PID:5204

C:\Users\Admin\Documents\Nar0CLlcdepPHU87aBAGmNua.exe
"C:\Users\Admin\Documents\Nar0CLlcdepPHU87aBAGmNua.exe"
3⤵
PID:5476

C:\Users\Admin\Documents\p7ld11LS4a8gDUIzXPHQ6rs9.exe
"C:\Users\Admin\Documents\p7ld11LS4a8gDUIzXPHQ6rs9.exe"
3⤵
PID:6368

C:\Users\Admin\Documents\RaPWtK6O9XrjAxzKOY5Vccsx.exe
"C:\Users\Admin\Documents\RaPWtK6O9XrjAxzKOY5Vccsx.exe"
3⤵
PID:6648

C:\Users\Admin\Documents\6ThauhA4TGIrXT2mkZEtz4ww.exe
"C:\Users\Admin\Documents\6ThauhA4TGIrXT2mkZEtz4ww.exe"
3⤵
PID:4148

C:\Users\Admin\Documents\TwdsW7wDP34TPRmRZglpesMh.exe
"C:\Users\Admin\Documents\TwdsW7wDP34TPRmRZglpesMh.exe"
3⤵
PID:4424

C:\Users\Admin\Documents\TwdsW7wDP34TPRmRZglpesMh.exe
C:\Users\Admin\Documents\TwdsW7wDP34TPRmRZglpesMh.exe
4⤵
PID:7568

C:\Users\Admin\Documents\k5xhLCslWQAq4GVfcoe3ATdI.exe
"C:\Users\Admin\Documents\k5xhLCslWQAq4GVfcoe3ATdI.exe"
3⤵
PID:5060

C:\Users\Admin\Documents\k5xhLCslWQAq4GVfcoe3ATdI.exe
C:\Users\Admin\Documents\k5xhLCslWQAq4GVfcoe3ATdI.exe
4⤵
PID:7492

C:\Users\Admin\Documents\k5xhLCslWQAq4GVfcoe3ATdI.exe
C:\Users\Admin\Documents\k5xhLCslWQAq4GVfcoe3ATdI.exe
4⤵
PID:7828

C:\Users\Admin\Documents\TVbPvAFUZthgRxT6KjiKislJ.exe
"C:\Users\Admin\Documents\TVbPvAFUZthgRxT6KjiKislJ.exe"
3⤵
PID:472

C:\Users\Admin\Documents\Ssv7kBTuhPO2ucpPw9_epifR.exe
"C:\Users\Admin\Documents\Ssv7kBTuhPO2ucpPw9_epifR.exe"
3⤵
PID:4700

C:\Users\Admin\Documents\lDeJzkHMtsdq6LKUw6UpWevC.exe
"C:\Users\Admin\Documents\lDeJzkHMtsdq6LKUw6UpWevC.exe"
3⤵
PID:6480

C:\Users\Admin\Documents\lDeJzkHMtsdq6LKUw6UpWevC.exe
C:\Users\Admin\Documents\lDeJzkHMtsdq6LKUw6UpWevC.exe
4⤵
PID:7684

C:\Users\Admin\Documents\ehNEbj4uCd6ks1MGpPWRBdlK.exe
"C:\Users\Admin\Documents\ehNEbj4uCd6ks1MGpPWRBdlK.exe"
3⤵
PID:7180

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:5764

C:\Users\Admin\Documents\_U1YAfAw0krg7BYeeZ4XymUZ.exe
"C:\Users\Admin\Documents\_U1YAfAw0krg7BYeeZ4XymUZ.exe"
3⤵
PID:7212

C:\Users\Admin\Documents\t31KRVDb8pHODVr2qF0r667F.exe
"C:\Users\Admin\Documents\t31KRVDb8pHODVr2qF0r667F.exe"
3⤵
PID:7232

C:\Users\Admin\Documents\MJ_pMWNs03GlypRmCK0ihnPt.exe
"C:\Users\Admin\Documents\MJ_pMWNs03GlypRmCK0ihnPt.exe"
3⤵
PID:7848

C:\Users\Admin\Documents\TkXPNfzogiHgR5wFIing05OI.exe
"C:\Users\Admin\Documents\TkXPNfzogiHgR5wFIing05OI.exe"
3⤵
PID:7840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 760
4⤵
- Program crash
PID:8120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 784
4⤵
- Program crash
PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 772
4⤵
- Program crash
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 828
4⤵
- Program crash
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 1060
4⤵
- Program crash
PID:3296

C:\Users\Admin\Documents\IjY7ZJ9WTsg0NUjHBa5q3Wua.exe
"C:\Users\Admin\Documents\IjY7ZJ9WTsg0NUjHBa5q3Wua.exe"
3⤵
PID:7944

C:\Users\Admin\Documents\W830SaRvv8Wo7HWFLqBF5aGr.exe
"C:\Users\Admin\Documents\W830SaRvv8Wo7HWFLqBF5aGr.exe"
3⤵
PID:7972

C:\Users\Admin\AppData\Roaming\1134203.exe
"C:\Users\Admin\AppData\Roaming\1134203.exe"
4⤵
PID:8176

C:\Users\Admin\AppData\Roaming\3821611.exe
"C:\Users\Admin\AppData\Roaming\3821611.exe"
4⤵
PID:1588

C:\Users\Admin\Documents\A_PN_wfNWk2ijPoetJjlA2yb.exe
"C:\Users\Admin\Documents\A_PN_wfNWk2ijPoetJjlA2yb.exe"
3⤵
PID:7936

C:\Users\Admin\Documents\A_PN_wfNWk2ijPoetJjlA2yb.exe
"C:\Users\Admin\Documents\A_PN_wfNWk2ijPoetJjlA2yb.exe"
4⤵
PID:7296

C:\Users\Admin\Documents\uPnJyY3Su9wKjJVOPDqbEixE.exe
"C:\Users\Admin\Documents\uPnJyY3Su9wKjJVOPDqbEixE.exe"
3⤵
PID:7928

C:\Users\Admin\Documents\54QabG1IgoZF5rSjJ_OuVfea.exe
"C:\Users\Admin\Documents\54QabG1IgoZF5rSjJ_OuVfea.exe"
3⤵
PID:7920

C:\Users\Admin\AppData\Roaming\5007632.exe
"C:\Users\Admin\AppData\Roaming\5007632.exe"
4⤵
PID:6068

C:\Users\Admin\AppData\Roaming\5741268.exe
"C:\Users\Admin\AppData\Roaming\5741268.exe"
4⤵
PID:7620

C:\Users\Admin\Documents\UJ_ry2AbQC0iZHhdZmrHa1SV.exe
"C:\Users\Admin\Documents\UJ_ry2AbQC0iZHhdZmrHa1SV.exe"
3⤵
PID:7912

C:\Users\Admin\Documents\twilL0NyntxIOTpnR7i1m6fv.exe
"C:\Users\Admin\Documents\twilL0NyntxIOTpnR7i1m6fv.exe"
3⤵
PID:7904

C:\Users\Admin\Documents\MTh4QaVc40v0hz0FZMjEKolE.exe
"C:\Users\Admin\Documents\MTh4QaVc40v0hz0FZMjEKolE.exe"
3⤵
PID:6800

C:\Users\Admin\AppData\Local\Temp\is-F3CRT.tmp\MTh4QaVc40v0hz0FZMjEKolE.tmp
"C:\Users\Admin\AppData\Local\Temp\is-F3CRT.tmp\MTh4QaVc40v0hz0FZMjEKolE.tmp" /SL5="$20398,138429,56832,C:\Users\Admin\Documents\MTh4QaVc40v0hz0FZMjEKolE.exe"
4⤵
PID:4968

C:\Users\Admin\Documents\YWxHhqwSztANLVxjfEdnJxlM.exe
"C:\Users\Admin\Documents\YWxHhqwSztANLVxjfEdnJxlM.exe"
3⤵
PID:4336

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
PID:4948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2068

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1224

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4456

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\55ee55dc77f64b10b3473336f392c40d /t 0 /p 4596
1⤵
PID:4744

C:\Users\Admin\AppData\Local\Temp\8AE6.exe
C:\Users\Admin\AppData\Local\Temp\8AE6.exe
1⤵
PID:2348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery