redline | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (16).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

redline dibild2 mix pro discovery evasion infostealer persistence spyware stealer themida trojan

Malware Config

Extracted

Family

redline

205.185.119.191:18846

Extracted

Family

redline

Botnet

dibild2

135.148.139.222:1494

Extracted

Family

redline

Botnet

pro

95.217.117.91:49317

Extracted

Family

redline

Botnet

MIX

manazyxsa.xyz:80

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2736	rundll32.exe	69

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 7 IoCs

resource	yara_rule
behavioral15/memory/1560-178-0x00000000003E0000-0x00000000003FC000-memory.dmp	family_redline
behavioral15/memory/1464-184-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral15/memory/1464-187-0x000000000041A616-mapping.dmp	family_redline
behavioral15/memory/1560-189-0x0000000004700000-0x000000000471A000-memory.dmp	family_redline
behavioral15/memory/1332-219-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral15/memory/2100-248-0x0000000003D00000-0x0000000003D20000-memory.dmp	family_redline
behavioral15/memory/2100-249-0x0000000003D30000-0x0000000003D4E000-memory.dmp	family_redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 46 IoCs

pid	Process
1944	MxbRPfobz6sIBWA9JDdJD3u5.exe
1420	nCnNtht2A4WOLrrSVkHhmyRC.exe
1616	5FZ8Ae7JaqT1jQoL7ZxlZZqZ.exe
752	ttk_T_P1ZzNBtIy1fT3TQ9pD.exe
524	dUI0UBK8lJEi3VRCWX0iRaxZ.exe
2044	sDSzTjtznv8VNcz8G7YQwkbx.exe
840	Uo0I9FlSQHNposQ9bRXsMaKV.exe
1652	tsgTP3yDqtCYD16JFpgHexeR.exe
1628	3Ttn8fgw8_hlASszxVNipcdP.exe
1612	4j_XcEcNv6yyjYITGHdKmbIS.exe
1920	74TicK7KH3BtXxa9_IMZqCKL.exe
1560	EamziklM5mDURv9MKB9_04H9.exe
1760	LPWfxkIZRkv53Vqvm9YZD3lZ.exe
596	hcfH16raVvox89wMZtA3xzLD.exe
1728	50zF5PKTPo8sTzGbJh2ktdl7.exe
1312	wbBQm8_Upwwu7YM5mYgJh2Ec.exe
2008	7ILirgwQylPgIXUKR3B7q55z.exe
1812	RPtiUz_hTA4tG7lEkk_uyZrd.exe
824	HhP6FrPHgKJOe7CgYcImqGHi.exe
2068	Fk5SarZ1j7UcrqIycN2IrgZZ.exe
2156	FZx7E89ziCU4ImVJSyqvMqr3.exe
2188	qJXN4KzBHqN5RkQrm7cXg9_S.exe
2248	OOTh7DO3Gm_rXcqsQTeYj68m.exe
2264	RNZ0ykBCSJrG9CKyGG1Ln5qK.exe
2232	4oqjfzZnFkTSd6T4hfM7h8I_.exe
2476	cutm3.exe
2484	md8_8eus.exe
2644	MxbRPfobz6sIBWA9JDdJD3u5.exe
1668	D921.exe
3060	F79A.exe
2752	93BB.exe
1908	1E9.exe
2200	30C6.exe
2480	C9E4.exe
2748	vhfiect
852	5E6B.exe
2700	wufiect
2304	spoolsv.exe
2168	B553.exe
2100	76A.exe
2392	HhP6FrPHgKJOe7CgYcImqGHi.exe
2312	C9E4.exe
2732	C9E4.exe
3044	C9E4.exe
2872	wufiect
360	C9E4.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RNZ0ykBCSJrG9CKyGG1Ln5qK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RNZ0ykBCSJrG9CKyGG1Ln5qK.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation	Setup (16).exe

Loads dropped DLL 64 IoCs

pid	Process
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
1076	Setup (16).exe
2232	4oqjfzZnFkTSd6T4hfM7h8I_.exe
2232	4oqjfzZnFkTSd6T4hfM7h8I_.exe
2232	4oqjfzZnFkTSd6T4hfM7h8I_.exe
2832	rundll32.exe
2832	rundll32.exe
2832	rundll32.exe
2832	rundll32.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
2528	WerFault.exe
1276	WerFault.exe
1276	WerFault.exe
1276	WerFault.exe
1276	WerFault.exe
2200	30C6.exe
1908	1E9.exe
1908	1E9.exe
2480	C9E4.exe
3060	F79A.exe
3060	F79A.exe
3060	F79A.exe
3060	F79A.exe
3060	F79A.exe
3060	F79A.exe
3060	F79A.exe
2312	C9E4.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1140	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral15/files/0x000300000001313a-67.dat	themida
behavioral15/files/0x000300000001313a-77.dat	themida
behavioral15/files/0x000300000001317a-125.dat	themida
behavioral15/files/0x0003000000013186-149.dat	themida
behavioral15/files/0x000300000001317a-151.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run	1E9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\spoolsv.exe\" -start"	1E9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c1ec45c8-5251-41a1-8ca9-04b8dea24a9c\\C9E4.exe\" --AutoStart"	C9E4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RNZ0ykBCSJrG9CKyGG1Ln5qK.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
202	geoiptool.com
221	api.2ip.ua
222	api.2ip.ua
20	ipinfo.io
21	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2264	RNZ0ykBCSJrG9CKyGG1Ln5qK.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 2644	1944	MxbRPfobz6sIBWA9JDdJD3u5.exe	68
PID 1612 set thread context of 1464	1612	4j_XcEcNv6yyjYITGHdKmbIS.exe	72
PID 2200 set thread context of 1332	2200	30C6.exe	96
PID 2480 set thread context of 2312	2480	C9E4.exe	114
PID 2748 set thread context of 2132	2748	vhfiect	116
PID 2732 set thread context of 360	2732	C9E4.exe	123
PID 3044 set thread context of 2880	3044	C9E4.exe	125

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	4oqjfzZnFkTSd6T4hfM7h8I_.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	4oqjfzZnFkTSd6T4hfM7h8I_.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	4oqjfzZnFkTSd6T4hfM7h8I_.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst1.exe	4oqjfzZnFkTSd6T4hfM7h8I_.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	4oqjfzZnFkTSd6T4hfM7h8I_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1276	524	WerFault.exe	33
2528	2008	WerFault.exe	49

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MxbRPfobz6sIBWA9JDdJD3u5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wufiect
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wufiect
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wufiect
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wufiect
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wufiect
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hcfH16raVvox89wMZtA3xzLD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MxbRPfobz6sIBWA9JDdJD3u5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MxbRPfobz6sIBWA9JDdJD3u5.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wufiect
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hcfH16raVvox89wMZtA3xzLD.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hcfH16raVvox89wMZtA3xzLD.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2152	taskkill.exe
596	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-22 = "Cape Verde Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-582 = "North Asia East Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-552 = "North Asia Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-421 = "Russian Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	HhP6FrPHgKJOe7CgYcImqGHi.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (16).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	dUI0UBK8lJEi3VRCWX0iRaxZ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	dUI0UBK8lJEi3VRCWX0iRaxZ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	dUI0UBK8lJEi3VRCWX0iRaxZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (16).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Setup (16).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	dUI0UBK8lJEi3VRCWX0iRaxZ.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	131	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1076	Setup (16).exe
596	hcfH16raVvox89wMZtA3xzLD.exe
596	hcfH16raVvox89wMZtA3xzLD.exe
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1256	Process not Found
1276	WerFault.exe
2528	WerFault.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
596	hcfH16raVvox89wMZtA3xzLD.exe
2644	MxbRPfobz6sIBWA9JDdJD3u5.exe
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
1256	Process not Found
2700	wufiect
2872	wufiect

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	EamziklM5mDURv9MKB9_04H9.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	2528	WerFault.exe
Token: SeShutdownPrivilege	1256	Process not Found
Token: SeShutdownPrivilege	1256	Process not Found
Token: SeDebugPrivilege	1276	WerFault.exe
Token: SeShutdownPrivilege	1256	Process not Found
Token: SeDebugPrivilege	1908	1E9.exe
Token: SeDebugPrivilege	1908	1E9.exe
Token: SeDebugPrivilege	824	HhP6FrPHgKJOe7CgYcImqGHi.exe
Token: SeImpersonatePrivilege	824	HhP6FrPHgKJOe7CgYcImqGHi.exe
Token: SeShutdownPrivilege	1256	Process not Found
Token: SeShutdownPrivilege	1256	Process not Found
Token: SeDebugPrivilege	2100	76A.exe
Token: SeShutdownPrivilege	1256	Process not Found
Token: SeShutdownPrivilege	1256	Process not Found
Token: SeShutdownPrivilege	1256	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1944	1076	Setup (16).exe	31
PID 1076 wrote to memory of 1944	1076	Setup (16).exe	31
PID 1076 wrote to memory of 1944	1076	Setup (16).exe	31
PID 1076 wrote to memory of 1944	1076	Setup (16).exe	31
PID 1076 wrote to memory of 752	1076	Setup (16).exe	35
PID 1076 wrote to memory of 752	1076	Setup (16).exe	35
PID 1076 wrote to memory of 752	1076	Setup (16).exe	35
PID 1076 wrote to memory of 752	1076	Setup (16).exe	35
PID 1076 wrote to memory of 752	1076	Setup (16).exe	35
PID 1076 wrote to memory of 752	1076	Setup (16).exe	35
PID 1076 wrote to memory of 752	1076	Setup (16).exe	35
PID 1076 wrote to memory of 1616	1076	Setup (16).exe	34
PID 1076 wrote to memory of 1616	1076	Setup (16).exe	34
PID 1076 wrote to memory of 1616	1076	Setup (16).exe	34
PID 1076 wrote to memory of 1616	1076	Setup (16).exe	34
PID 1076 wrote to memory of 524	1076	Setup (16).exe	33
PID 1076 wrote to memory of 524	1076	Setup (16).exe	33
PID 1076 wrote to memory of 524	1076	Setup (16).exe	33
PID 1076 wrote to memory of 524	1076	Setup (16).exe	33
PID 1076 wrote to memory of 2044	1076	Setup (16).exe	36
PID 1076 wrote to memory of 2044	1076	Setup (16).exe	36
PID 1076 wrote to memory of 2044	1076	Setup (16).exe	36
PID 1076 wrote to memory of 2044	1076	Setup (16).exe	36
PID 1076 wrote to memory of 1596	1076	Setup (16).exe	37
PID 1076 wrote to memory of 1596	1076	Setup (16).exe	37
PID 1076 wrote to memory of 1596	1076	Setup (16).exe	37
PID 1076 wrote to memory of 1596	1076	Setup (16).exe	37
PID 1076 wrote to memory of 1596	1076	Setup (16).exe	37
PID 1076 wrote to memory of 1596	1076	Setup (16).exe	37
PID 1076 wrote to memory of 1596	1076	Setup (16).exe	37
PID 1076 wrote to memory of 1628	1076	Setup (16).exe	40
PID 1076 wrote to memory of 1628	1076	Setup (16).exe	40
PID 1076 wrote to memory of 1628	1076	Setup (16).exe	40
PID 1076 wrote to memory of 1628	1076	Setup (16).exe	40
PID 1076 wrote to memory of 1652	1076	Setup (16).exe	39
PID 1076 wrote to memory of 1652	1076	Setup (16).exe	39
PID 1076 wrote to memory of 1652	1076	Setup (16).exe	39
PID 1076 wrote to memory of 1652	1076	Setup (16).exe	39
PID 1076 wrote to memory of 840	1076	Setup (16).exe	41
PID 1076 wrote to memory of 840	1076	Setup (16).exe	41
PID 1076 wrote to memory of 840	1076	Setup (16).exe	41
PID 1076 wrote to memory of 840	1076	Setup (16).exe	41
PID 1076 wrote to memory of 840	1076	Setup (16).exe	41
PID 1076 wrote to memory of 840	1076	Setup (16).exe	41
PID 1076 wrote to memory of 840	1076	Setup (16).exe	41
PID 1076 wrote to memory of 1920	1076	Setup (16).exe	43
PID 1076 wrote to memory of 1920	1076	Setup (16).exe	43
PID 1076 wrote to memory of 1920	1076	Setup (16).exe	43
PID 1076 wrote to memory of 1920	1076	Setup (16).exe	43
PID 1076 wrote to memory of 1612	1076	Setup (16).exe	42
PID 1076 wrote to memory of 1612	1076	Setup (16).exe	42
PID 1076 wrote to memory of 1612	1076	Setup (16).exe	42
PID 1076 wrote to memory of 1612	1076	Setup (16).exe	42
PID 1076 wrote to memory of 1728	1076	Setup (16).exe	44
PID 1076 wrote to memory of 1728	1076	Setup (16).exe	44
PID 1076 wrote to memory of 1728	1076	Setup (16).exe	44
PID 1076 wrote to memory of 1728	1076	Setup (16).exe	44
PID 1076 wrote to memory of 1560	1076	Setup (16).exe	53
PID 1076 wrote to memory of 1560	1076	Setup (16).exe	53
PID 1076 wrote to memory of 1560	1076	Setup (16).exe	53
PID 1076 wrote to memory of 1560	1076	Setup (16).exe	53
PID 1076 wrote to memory of 1760	1076	Setup (16).exe	52
PID 1076 wrote to memory of 1760	1076	Setup (16).exe	52
PID 1076 wrote to memory of 1760	1076	Setup (16).exe	52

C:\Users\Admin\AppData\Local\Temp\Setup (16).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (16).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\Documents\MxbRPfobz6sIBWA9JDdJD3u5.exe
  "C:\Users\Admin\Documents\MxbRPfobz6sIBWA9JDdJD3u5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1944
- - C:\Users\Admin\Documents\MxbRPfobz6sIBWA9JDdJD3u5.exe
    "C:\Users\Admin\Documents\MxbRPfobz6sIBWA9JDdJD3u5.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2644
- C:\Users\Admin\Documents\nCnNtht2A4WOLrrSVkHhmyRC.exe
  "C:\Users\Admin\Documents\nCnNtht2A4WOLrrSVkHhmyRC.exe"
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Users\Admin\Documents\dUI0UBK8lJEi3VRCWX0iRaxZ.exe
  "C:\Users\Admin\Documents\dUI0UBK8lJEi3VRCWX0iRaxZ.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 864
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- C:\Users\Admin\Documents\5FZ8Ae7JaqT1jQoL7ZxlZZqZ.exe
  "C:\Users\Admin\Documents\5FZ8Ae7JaqT1jQoL7ZxlZZqZ.exe"
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Users\Admin\Documents\ttk_T_P1ZzNBtIy1fT3TQ9pD.exe
  "C:\Users\Admin\Documents\ttk_T_P1ZzNBtIy1fT3TQ9pD.exe"
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Users\Admin\Documents\sDSzTjtznv8VNcz8G7YQwkbx.exe
  "C:\Users\Admin\Documents\sDSzTjtznv8VNcz8G7YQwkbx.exe"
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Users\Admin\Documents\d_R07Bqj0y1PZCXcHb6lx3_n.exe
  "C:\Users\Admin\Documents\d_R07Bqj0y1PZCXcHb6lx3_n.exe"
  2⤵
  PID:1596
- C:\Users\Admin\Documents\tsgTP3yDqtCYD16JFpgHexeR.exe
  "C:\Users\Admin\Documents\tsgTP3yDqtCYD16JFpgHexeR.exe"
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "tsgTP3yDqtCYD16JFpgHexeR.exe" /f & erase "C:\Users\Admin\Documents\tsgTP3yDqtCYD16JFpgHexeR.exe" & exit
    3⤵
    PID:1716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "tsgTP3yDqtCYD16JFpgHexeR.exe" /f
      4⤵
      Kills process with taskkill
      PID:596
- C:\Users\Admin\Documents\3Ttn8fgw8_hlASszxVNipcdP.exe
  "C:\Users\Admin\Documents\3Ttn8fgw8_hlASszxVNipcdP.exe"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Users\Admin\Documents\Uo0I9FlSQHNposQ9bRXsMaKV.exe
  "C:\Users\Admin\Documents\Uo0I9FlSQHNposQ9bRXsMaKV.exe"
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Users\Admin\Documents\4j_XcEcNv6yyjYITGHdKmbIS.exe
  "C:\Users\Admin\Documents\4j_XcEcNv6yyjYITGHdKmbIS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1612
- - C:\Users\Admin\Documents\4j_XcEcNv6yyjYITGHdKmbIS.exe
    C:\Users\Admin\Documents\4j_XcEcNv6yyjYITGHdKmbIS.exe
    3⤵
    PID:1464
- C:\Users\Admin\Documents\74TicK7KH3BtXxa9_IMZqCKL.exe
  "C:\Users\Admin\Documents\74TicK7KH3BtXxa9_IMZqCKL.exe"
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Users\Admin\Documents\50zF5PKTPo8sTzGbJh2ktdl7.exe
  "C:\Users\Admin\Documents\50zF5PKTPo8sTzGbJh2ktdl7.exe"
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Users\Admin\Documents\HhP6FrPHgKJOe7CgYcImqGHi.exe
  "C:\Users\Admin\Documents\HhP6FrPHgKJOe7CgYcImqGHi.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:824
- - C:\Users\Admin\Documents\HhP6FrPHgKJOe7CgYcImqGHi.exe
    "C:\Users\Admin\Documents\HhP6FrPHgKJOe7CgYcImqGHi.exe"
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    PID:2392
- C:\Users\Admin\Documents\wbBQm8_Upwwu7YM5mYgJh2Ec.exe
  "C:\Users\Admin\Documents\wbBQm8_Upwwu7YM5mYgJh2Ec.exe"
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Users\Admin\Documents\RPtiUz_hTA4tG7lEkk_uyZrd.exe
  "C:\Users\Admin\Documents\RPtiUz_hTA4tG7lEkk_uyZrd.exe"
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Users\Admin\Documents\7ILirgwQylPgIXUKR3B7q55z.exe
  "C:\Users\Admin\Documents\7ILirgwQylPgIXUKR3B7q55z.exe"
  2⤵
  - Executes dropped EXE
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 856
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- C:\Users\Admin\Documents\kTOgpBKJUeBIDsSFvJTvRVrO.exe
  "C:\Users\Admin\Documents\kTOgpBKJUeBIDsSFvJTvRVrO.exe"
  2⤵
  PID:1700
- C:\Users\Admin\Documents\hcfH16raVvox89wMZtA3xzLD.exe
  "C:\Users\Admin\Documents\hcfH16raVvox89wMZtA3xzLD.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:596
- C:\Users\Admin\Documents\LPWfxkIZRkv53Vqvm9YZD3lZ.exe
  "C:\Users\Admin\Documents\LPWfxkIZRkv53Vqvm9YZD3lZ.exe"
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Users\Admin\Documents\EamziklM5mDURv9MKB9_04H9.exe
  "C:\Users\Admin\Documents\EamziklM5mDURv9MKB9_04H9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Users\Admin\Documents\RNZ0ykBCSJrG9CKyGG1Ln5qK.exe
  "C:\Users\Admin\Documents\RNZ0ykBCSJrG9CKyGG1Ln5qK.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2264
- C:\Users\Admin\Documents\OOTh7DO3Gm_rXcqsQTeYj68m.exe
  "C:\Users\Admin\Documents\OOTh7DO3Gm_rXcqsQTeYj68m.exe"
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Users\Admin\Documents\4oqjfzZnFkTSd6T4hfM7h8I_.exe
  "C:\Users\Admin\Documents\4oqjfzZnFkTSd6T4hfM7h8I_.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2232
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:2476
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:2484
- - C:\Program Files (x86)\Company\NewProduct\inst1.exe
    "C:\Program Files (x86)\Company\NewProduct\inst1.exe"
    3⤵
    PID:2536
- C:\Users\Admin\Documents\qJXN4KzBHqN5RkQrm7cXg9_S.exe
  "C:\Users\Admin\Documents\qJXN4KzBHqN5RkQrm7cXg9_S.exe"
  2⤵
  - Executes dropped EXE
  PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "qJXN4KzBHqN5RkQrm7cXg9_S.exe" /f & erase "C:\Users\Admin\Documents\qJXN4KzBHqN5RkQrm7cXg9_S.exe" & exit
    3⤵
    PID:1588
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "qJXN4KzBHqN5RkQrm7cXg9_S.exe" /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2152
- C:\Users\Admin\Documents\FZx7E89ziCU4ImVJSyqvMqr3.exe
  "C:\Users\Admin\Documents\FZx7E89ziCU4ImVJSyqvMqr3.exe"
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Users\Admin\Documents\Fk5SarZ1j7UcrqIycN2IrgZZ.exe
  "C:\Users\Admin\Documents\Fk5SarZ1j7UcrqIycN2IrgZZ.exe"
  2⤵
  - Executes dropped EXE
  PID:2068

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:2832

C:\Users\Admin\AppData\Local\Temp\C9E4.exe
C:\Users\Admin\AppData\Local\Temp\C9E4.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2480
- C:\Users\Admin\AppData\Local\Temp\C9E4.exe
  C:\Users\Admin\AppData\Local\Temp\C9E4.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:2312
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\c1ec45c8-5251-41a1-8ca9-04b8dea24a9c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\C9E4.exe
    "C:\Users\Admin\AppData\Local\Temp\C9E4.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\C9E4.exe
      "C:\Users\Admin\AppData\Local\Temp\C9E4.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:360

C:\Users\Admin\AppData\Local\Temp\D921.exe
C:\Users\Admin\AppData\Local\Temp\D921.exe
1⤵
- Executes dropped EXE
PID:1668

C:\Users\Admin\AppData\Local\Temp\F79A.exe
C:\Users\Admin\AppData\Local\Temp\F79A.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060

C:\Users\Admin\AppData\Local\Temp\93BB.exe
C:\Users\Admin\AppData\Local\Temp\93BB.exe
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\system32\taskeng.exe
taskeng.exe {ED90DA0A-6321-4ABC-8489-0E2F541BA2B9} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
PID:1968
- C:\Users\Admin\AppData\Roaming\vhfiect
  C:\Users\Admin\AppData\Roaming\vhfiect
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2748
- - C:\Users\Admin\AppData\Roaming\vhfiect
    C:\Users\Admin\AppData\Roaming\vhfiect
    3⤵
    PID:2132
- C:\Users\Admin\AppData\Roaming\wufiect
  C:\Users\Admin\AppData\Roaming\wufiect
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2700
- C:\Users\Admin\AppData\Local\c1ec45c8-5251-41a1-8ca9-04b8dea24a9c\C9E4.exe
  C:\Users\Admin\AppData\Local\c1ec45c8-5251-41a1-8ca9-04b8dea24a9c\C9E4.exe --Task
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3044
- - C:\Users\Admin\AppData\Local\c1ec45c8-5251-41a1-8ca9-04b8dea24a9c\C9E4.exe
    C:\Users\Admin\AppData\Local\c1ec45c8-5251-41a1-8ca9-04b8dea24a9c\C9E4.exe --Task
    3⤵
    PID:2880
- C:\Users\Admin\AppData\Roaming\wufiect
  C:\Users\Admin\AppData\Roaming\wufiect
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2872

C:\Users\Admin\AppData\Local\Temp\1E9.exe
C:\Users\Admin\AppData\Local\Temp\1E9.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1908
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:2440

C:\Users\Admin\AppData\Local\Temp\30C6.exe
C:\Users\Admin\AppData\Local\Temp\30C6.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2200
- C:\Users\Admin\AppData\Local\Temp\30C6.exe
  C:\Users\Admin\AppData\Local\Temp\30C6.exe
  2⤵
  PID:1332

C:\Users\Admin\AppData\Local\Temp\5E6B.exe
C:\Users\Admin\AppData\Local\Temp\5E6B.exe
1⤵
- Executes dropped EXE
PID:852

C:\Users\Admin\AppData\Local\Temp\740F.exe
C:\Users\Admin\AppData\Local\Temp\740F.exe
1⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\B553.exe
C:\Users\Admin\AppData\Local\Temp\B553.exe
1⤵
- Executes dropped EXE
PID:2168

C:\Users\Admin\AppData\Local\Temp\76A.exe
C:\Users\Admin\AppData\Local\Temp\76A.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2772

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1916

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1672

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1844

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2820

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:952

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-154-0x0000000001100000-0x0000000001101000-memory.dmp

Filesize
4KB

Download
memory/852-215-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1076-60-0x00000000768B1000-0x00000000768B3000-memory.dmp

Filesize
8KB

Download
memory/1076-61-0x0000000003CE0000-0x0000000003E1F000-memory.dmp

Filesize
1.2MB

Download
memory/1332-219-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1464-184-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1560-178-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/1560-171-0x00000000002B0000-0x00000000002DF000-memory.dmp

Filesize
188KB

Download
memory/1560-189-0x0000000004700000-0x000000000471A000-memory.dmp

Filesize
104KB

Download
memory/1560-181-0x0000000000400000-0x0000000002CD0000-memory.dmp

Filesize
40.8MB

Download
memory/1560-186-0x0000000004BC1000-0x0000000004BC2000-memory.dmp

Filesize
4KB

Download
memory/1560-188-0x0000000004BC2000-0x0000000004BC3000-memory.dmp

Filesize
4KB

Download
memory/1560-190-0x0000000004BC3000-0x0000000004BC4000-memory.dmp

Filesize
4KB

Download
memory/1612-166-0x0000000001060000-0x0000000001061000-memory.dmp

Filesize
4KB

Download
memory/1612-183-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/1616-155-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1628-142-0x000007FEFC221000-0x000007FEFC223000-memory.dmp

Filesize
8KB

Download
memory/1672-233-0x00000000726B1000-0x00000000726B3000-memory.dmp

Filesize
8KB

Download
memory/1760-156-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/1812-152-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1944-180-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/2044-172-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/2100-248-0x0000000003D00000-0x0000000003D20000-memory.dmp

Filesize
128KB

Download
memory/2100-249-0x0000000003D30000-0x0000000003D4E000-memory.dmp

Filesize
120KB

Download
memory/2188-185-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/2200-217-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/2248-161-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2248-163-0x0000000000120000-0x0000000000132000-memory.dmp

Filesize
72KB

Download
memory/2312-242-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2484-168-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2644-176-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download