redline | 5248d778a816ffaed27e465deec140f4d79478a4aca7c5968d6eb926ac7c94f1

System Information Discovery

Processes:

AHnCaIcVBLx94SJcFz7fNjqb.exe75DE.exe8279548.exeY322X8FwiwJOGzG2a1PNjHC3.exe1A0A.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AHnCaIcVBLx94SJcFz7fNjqb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AHnCaIcVBLx94SJcFz7fNjqb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	75DE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	75DE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8279548.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8279548.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Y322X8FwiwJOGzG2a1PNjHC3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Y322X8FwiwJOGzG2a1PNjHC3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1A0A.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1A0A.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Wed229825989c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Control Panel\International\Geo\Nation	Wed229825989c.exe

Loads dropped DLL 64 IoCs

Processes:

a4806a7fffe5d04d7ccd764890bd4ef3.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeWed226b251ef55.exeWed2260b25c317.exeWed226b6e8b18c18b003.exeWed22d29285f2462824d.exeWed224b216a9b264.execmd.exeWed221ce23cd2c4a6.execmd.exeWed222a0abb0f39640f.exeWed229825989c.exeWed221ce23cd2c4a6.tmpLzmwAqmV.exerundll32.exeWerFault.exe

pid	process
568	a4806a7fffe5d04d7ccd764890bd4ef3.exe
1384	setup_installer.exe
1384	setup_installer.exe
1384	setup_installer.exe
1384	setup_installer.exe
1384	setup_installer.exe
1384	setup_installer.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1888	setup_install.exe
1176	cmd.exe
1600	cmd.exe
1600	cmd.exe
1800	cmd.exe
1800	cmd.exe
828	cmd.exe
948	cmd.exe
916	cmd.exe
1168	cmd.exe
1488	cmd.exe
1840	cmd.exe
592	cmd.exe
592	cmd.exe
280	Wed226b251ef55.exe
280	Wed226b251ef55.exe
568	Wed2260b25c317.exe
568	Wed2260b25c317.exe
816	Wed226b6e8b18c18b003.exe
816	Wed226b6e8b18c18b003.exe
1200	Wed22d29285f2462824d.exe
1200	Wed22d29285f2462824d.exe
432	Wed224b216a9b264.exe
432	Wed224b216a9b264.exe
1792	cmd.exe
1792	cmd.exe
1540	Wed221ce23cd2c4a6.exe
1540	Wed221ce23cd2c4a6.exe
852	cmd.exe
288	Wed222a0abb0f39640f.exe
288	Wed222a0abb0f39640f.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1540	Wed221ce23cd2c4a6.exe
1320	Wed221ce23cd2c4a6.tmp
1320	Wed221ce23cd2c4a6.tmp
1320	Wed221ce23cd2c4a6.tmp
1320	Wed221ce23cd2c4a6.tmp
1096	Wed229825989c.exe
568	Wed2260b25c317.exe
2600	LzmwAqmV.exe
2600	LzmwAqmV.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2664	rundll32.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe
2728	WerFault.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1632 icacls.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1632	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

___YHDG34.exeA708.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Waqaebegile.exe\""	___YHDG34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\40a31da1-c186-4fed-9849-d7ca69d7191c\\A708.exe\" --AutoStart"	A708.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

Processes:

1A0A.exe8279548.exeY322X8FwiwJOGzG2a1PNjHC3.exeAHnCaIcVBLx94SJcFz7fNjqb.exe75DE.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1A0A.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8279548.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Y322X8FwiwJOGzG2a1PNjHC3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AHnCaIcVBLx94SJcFz7fNjqb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	75DE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

46 ipinfo.io
47 ipinfo.io
206 ip-api.com
233 api.2ip.ua
234 api.2ip.ua
253 api.2ip.ua
16 ip-api.com

flow	ioc
46	ipinfo.io
47	ipinfo.io
206	ip-api.com
233	api.2ip.ua
234	api.2ip.ua
253	api.2ip.ua
16	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

ShadowVPNInstaller_v5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ShadowVPNInstaller_v5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	ShadowVPNInstaller_v5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

Y322X8FwiwJOGzG2a1PNjHC3.exeAHnCaIcVBLx94SJcFz7fNjqb.exe75DE.exe1A0A.exe8279548.exe

pid process

2400 Y322X8FwiwJOGzG2a1PNjHC3.exe
1804 AHnCaIcVBLx94SJcFz7fNjqb.exe
3364 75DE.exe
2584 1A0A.exe
2976 8279548.exe

pid	process
2400	Y322X8FwiwJOGzG2a1PNjHC3.exe
1804	AHnCaIcVBLx94SJcFz7fNjqb.exe
3364	75DE.exe
2584	1A0A.exe
2976	8279548.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

Wed2260b25c317.exeA708.exejZcipOy5FuEhLdNkiZv51cls.exeA708.exeA708.exe

description	pid	process	target process
PID 568 set thread context of 2552	568	Wed2260b25c317.exe	Wed2260b25c317.exe
PID 2112 set thread context of 2460	2112	A708.exe	TZWSGZ0DEcbnZNLPHNNjnFLp.exe
PID 828 set thread context of 3224	828	jZcipOy5FuEhLdNkiZv51cls.exe	jZcipOy5FuEhLdNkiZv51cls.exe
PID 2112 set thread context of 3384	2112	A708.exe	A708.exe
PID 3888 set thread context of 1384	3888	A708.exe	A708.exe
PID 3792 set thread context of 1524	3792	A708.exe	A708.exe

Drops file in Program Files directory 9 IoCs

Processes:

qj8cBGQEt4svrFloCnQuQFxN.exe___YHDG34.exe

description	ioc	process
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	qj8cBGQEt4svrFloCnQuQFxN.exe
File created	C:\Program Files\DVD Maker\XUTJAHOPZT\ultramediaburner.exe	___YHDG34.exe
File created	C:\Program Files\DVD Maker\XUTJAHOPZT\ultramediaburner.exe.config	___YHDG34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	qj8cBGQEt4svrFloCnQuQFxN.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	qj8cBGQEt4svrFloCnQuQFxN.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	qj8cBGQEt4svrFloCnQuQFxN.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Waqaebegile.exe	___YHDG34.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Waqaebegile.exe.config	___YHDG34.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	qj8cBGQEt4svrFloCnQuQFxN.exe

Drops file in Windows directory 1 IoCs

Processes:

description ioc process

File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2728	288	WerFault.exe	Wed222a0abb0f39640f.exe
2476	2864	WerFault.exe	2.exe
2384	1860	WerFault.exe	Wed22398ca1246818a50.exe
3528	2680	WerFault.exe	P0cQjjj93zyoHXmWai3HXJKY.exe
3876	1384	WerFault.exe	A708.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Wed226b6e8b18c18b003.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed226b6e8b18c18b003.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed226b6e8b18c18b003.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed226b6e8b18c18b003.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

4528 timeout.exe
4924 timeout.exe

pid	process
4528	timeout.exe
4924	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

ShadowVPNInstaller_v5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ShadowVPNInstaller_v5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	ShadowVPNInstaller_v5.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2212 taskkill.exe
4928 taskkill.exe

pid	process
2212	taskkill.exe
4928	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C306940-18B7-11EC-978D-4E46018E0C1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{694E04F0-18B6-11EC-978D-4E46018E0C1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4581CB20-18B5-11EC-978D-4E46018E0C1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{70FF5961-18B6-11EC-978D-4E46018E0C1C}.dat = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CF513E0-18B7-11EC-978D-4E46018E0C1C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Wed226b251ef55.exeWed2236d9fce9bd29d13.exeWed222a0abb0f39640f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Wed226b251ef55.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Wed226b251ef55.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Wed2236d9fce9bd29d13.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Wed2236d9fce9bd29d13.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Wed2236d9fce9bd29d13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Wed222a0abb0f39640f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Wed222a0abb0f39640f.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 13 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Wed226b6e8b18c18b003.exepowershell.exeWed229825989c.exemSsj6MdrMzd5VvO7Ls0FX5X6.exe

pid	process
816	Wed226b6e8b18c18b003.exe
816	Wed226b6e8b18c18b003.exe
1704	powershell.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1096	Wed229825989c.exe
1424
1424
1424
1424
1424
1424
1424
1424
1424
1424
1424
1424
1424
1424
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe
1424
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe
1424
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe
1424
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe
1424
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe
1424
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe
1424
2536	mSsj6MdrMzd5VvO7Ls0FX5X6.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid process

2728 WerFault.exe
1424
3528 WerFault.exe
3876 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Wed226b6e8b18c18b003.exe

pid process

816 Wed226b6e8b18c18b003.exe

pid	process
2728	WerFault.exe
1424
3528	WerFault.exe
3876	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Wed226b251ef55.exeWed2236d9fce9bd29d13.exeWed22214190470.exepowershell.exeWerFault.exe2.exePublicDwlBrowser1100.exe_1cHOL73ZihACwWP8sv1GqAE.exe

description	pid	process
Token: SeCreateTokenPrivilege	280	Wed226b251ef55.exe
Token: SeAssignPrimaryTokenPrivilege	280	Wed226b251ef55.exe
Token: SeLockMemoryPrivilege	280	Wed226b251ef55.exe
Token: SeIncreaseQuotaPrivilege	280	Wed226b251ef55.exe
Token: SeMachineAccountPrivilege	280	Wed226b251ef55.exe
Token: SeTcbPrivilege	280	Wed226b251ef55.exe
Token: SeSecurityPrivilege	280	Wed226b251ef55.exe
Token: SeTakeOwnershipPrivilege	280	Wed226b251ef55.exe
Token: SeLoadDriverPrivilege	280	Wed226b251ef55.exe
Token: SeSystemProfilePrivilege	280	Wed226b251ef55.exe
Token: SeSystemtimePrivilege	280	Wed226b251ef55.exe
Token: SeProfSingleProcessPrivilege	280	Wed226b251ef55.exe
Token: SeIncBasePriorityPrivilege	280	Wed226b251ef55.exe
Token: SeCreatePagefilePrivilege	280	Wed226b251ef55.exe
Token: SeCreatePermanentPrivilege	280	Wed226b251ef55.exe
Token: SeBackupPrivilege	280	Wed226b251ef55.exe
Token: SeRestorePrivilege	280	Wed226b251ef55.exe
Token: SeShutdownPrivilege	280	Wed226b251ef55.exe
Token: SeDebugPrivilege	280	Wed226b251ef55.exe
Token: SeAuditPrivilege	280	Wed226b251ef55.exe
Token: SeSystemEnvironmentPrivilege	280	Wed226b251ef55.exe
Token: SeChangeNotifyPrivilege	280	Wed226b251ef55.exe
Token: SeRemoteShutdownPrivilege	280	Wed226b251ef55.exe
Token: SeUndockPrivilege	280	Wed226b251ef55.exe
Token: SeSyncAgentPrivilege	280	Wed226b251ef55.exe
Token: SeEnableDelegationPrivilege	280	Wed226b251ef55.exe
Token: SeManageVolumePrivilege	280	Wed226b251ef55.exe
Token: SeImpersonatePrivilege	280	Wed226b251ef55.exe
Token: SeCreateGlobalPrivilege	280	Wed226b251ef55.exe
Token: 31	280	Wed226b251ef55.exe
Token: 32	280	Wed226b251ef55.exe
Token: 33	280	Wed226b251ef55.exe
Token: 34	280	Wed226b251ef55.exe
Token: 35	280	Wed226b251ef55.exe
Token: SeDebugPrivilege	968	Wed2236d9fce9bd29d13.exe
Token: SeDebugPrivilege	1904	Wed22214190470.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeShutdownPrivilege	1424
Token: SeDebugPrivilege	2728	WerFault.exe
Token: SeShutdownPrivilege	1424
Token: SeDebugPrivilege	2864	2.exe
Token: SeDebugPrivilege	2832	PublicDwlBrowser1100.exe
Token: SeShutdownPrivilege	1424
Token: SeCreateTokenPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeAssignPrimaryTokenPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeLockMemoryPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeIncreaseQuotaPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeMachineAccountPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeTcbPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeSecurityPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeTakeOwnershipPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeLoadDriverPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeSystemProfilePrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeSystemtimePrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeProfSingleProcessPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeIncBasePriorityPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeCreatePagefilePrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeCreatePermanentPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeBackupPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeRestorePrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeShutdownPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeDebugPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeAuditPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe
Token: SeSystemEnvironmentPrivilege	1936	_1cHOL73ZihACwWP8sv1GqAE.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1424
1424

pid	process
1424
1424

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

pid	process
2744	iexplore.exe
2744	iexplore.exe
284	iexplore.exe
284	iexplore.exe
4140	iexplore.exe
4140	iexplore.exe
4164	iexplore.exe
4164	iexplore.exe
4644	iexplore.exe
4644	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a4806a7fffe5d04d7ccd764890bd4ef3.exesetup_installer.exesetup_install.exe

description	pid	process	target process
PID 568 wrote to memory of 1384	568	a4806a7fffe5d04d7ccd764890bd4ef3.exe	setup_installer.exe
PID 568 wrote to memory of 1384	568	a4806a7fffe5d04d7ccd764890bd4ef3.exe	setup_installer.exe
PID 568 wrote to memory of 1384	568	a4806a7fffe5d04d7ccd764890bd4ef3.exe	setup_installer.exe
PID 568 wrote to memory of 1384	568	a4806a7fffe5d04d7ccd764890bd4ef3.exe	setup_installer.exe
PID 568 wrote to memory of 1384	568	a4806a7fffe5d04d7ccd764890bd4ef3.exe	setup_installer.exe
PID 568 wrote to memory of 1384	568	a4806a7fffe5d04d7ccd764890bd4ef3.exe	setup_installer.exe
PID 568 wrote to memory of 1384	568	a4806a7fffe5d04d7ccd764890bd4ef3.exe	setup_installer.exe
PID 1384 wrote to memory of 1888	1384	setup_installer.exe	setup_install.exe
PID 1384 wrote to memory of 1888	1384	setup_installer.exe	setup_install.exe
PID 1384 wrote to memory of 1888	1384	setup_installer.exe	setup_install.exe
PID 1384 wrote to memory of 1888	1384	setup_installer.exe	setup_install.exe
PID 1384 wrote to memory of 1888	1384	setup_installer.exe	setup_install.exe
PID 1384 wrote to memory of 1888	1384	setup_installer.exe	setup_install.exe
PID 1384 wrote to memory of 1888	1384	setup_installer.exe	setup_install.exe
PID 1888 wrote to memory of 1836	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1836	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1836	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1836	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1836	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1836	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1836	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 948	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 948	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 948	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 948	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 948	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 948	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 948	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 828	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 828	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 828	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 828	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 828	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 828	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 828	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1840	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1840	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1840	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1840	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1840	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1840	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1840	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1176	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1176	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1176	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1176	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1176	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1176	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1176	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1168	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1168	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1168	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1168	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1168	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1168	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1168	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1600	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1600	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1600	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1600	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1600	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1600	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 1600	1888	setup_install.exe	cmd.exe
PID 1888 wrote to memory of 852	1888	setup_install.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a4806a7fffe5d04d7ccd764890bd4ef3.exe
"C:\Users\Admin\AppData\Local\Temp\a4806a7fffe5d04d7ccd764890bd4ef3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1384

C:\Users\Admin\AppData\Local\Temp\7zS86592933\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS86592933\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
PID:1836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed22398ca1246818a50.exe
4⤵
- Loads dropped DLL
PID:948

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed22398ca1246818a50.exe
Wed22398ca1246818a50.exe
5⤵
- Executes dropped EXE
PID:1860

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1860 -s 792
6⤵
- Program crash
PID:2384

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed22214190470.exe
4⤵
- Loads dropped DLL
PID:828

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed22214190470.exe
Wed22214190470.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed226b251ef55.exe
4⤵
- Loads dropped DLL
PID:1840

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed226b251ef55.exe
Wed226b251ef55.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:280

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:2688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed2236d9fce9bd29d13.exe
4⤵
- Loads dropped DLL
PID:1176

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed2236d9fce9bd29d13.exe
Wed2236d9fce9bd29d13.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
7⤵
- Executes dropped EXE
PID:2788

C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\ProgramData\7944440.exe
"C:\ProgramData\7944440.exe"
8⤵
- Executes dropped EXE
PID:2004

C:\ProgramData\7868122.exe
"C:\ProgramData\7868122.exe"
8⤵
- Executes dropped EXE
PID:3032

C:\ProgramData\8279548.exe
"C:\ProgramData\8279548.exe"
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2976

C:\ProgramData\642105.exe
"C:\ProgramData\642105.exe"
8⤵
- Executes dropped EXE
PID:2452

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2864 -s 1428
8⤵
- Program crash
PID:2476

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:2900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
8⤵
PID:2052

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "setup.exe" /f
9⤵
- Kills process with taskkill
PID:2212

C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v5.exe
"C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v5.exe"
7⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
PID:3024

C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe
"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe"
7⤵
- Executes dropped EXE
PID:2288

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
7⤵
PID:2992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed2246f9dc6f4f9.exe
4⤵
- Loads dropped DLL
PID:1168

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed2246f9dc6f4f9.exe
Wed2246f9dc6f4f9.exe
5⤵
- Executes dropped EXE
PID:1812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed2260b25c317.exe
4⤵
- Loads dropped DLL
PID:1600

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed2260b25c317.exe
Wed2260b25c317.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:568

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed2260b25c317.exe
C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed2260b25c317.exe
6⤵
- Executes dropped EXE
PID:2552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed229825989c.exe
4⤵
- Loads dropped DLL
PID:852

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed229825989c.exe
Wed229825989c.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1096

C:\Users\Admin\Documents\mSsj6MdrMzd5VvO7Ls0FX5X6.exe
"C:\Users\Admin\Documents\mSsj6MdrMzd5VvO7Ls0FX5X6.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2536

C:\Users\Admin\Documents\Y322X8FwiwJOGzG2a1PNjHC3.exe
"C:\Users\Admin\Documents\Y322X8FwiwJOGzG2a1PNjHC3.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2400

C:\Users\Admin\Documents\_gVmVTJJTdBO_SkJRVhnep_1.exe
"C:\Users\Admin\Documents\_gVmVTJJTdBO_SkJRVhnep_1.exe"
6⤵
PID:1516

C:\Users\Admin\Documents\AHnCaIcVBLx94SJcFz7fNjqb.exe
"C:\Users\Admin\Documents\AHnCaIcVBLx94SJcFz7fNjqb.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1804

C:\Users\Admin\Documents\WfeQEeNXUHmEkcYJBOAF2ziI.exe
"C:\Users\Admin\Documents\WfeQEeNXUHmEkcYJBOAF2ziI.exe"
6⤵
- Executes dropped EXE
PID:1512

C:\Users\Admin\Documents\5ZlmkB0Ax7O8YQJ7glEv0EIZ.exe
"C:\Users\Admin\Documents\5ZlmkB0Ax7O8YQJ7glEv0EIZ.exe"
6⤵
- Executes dropped EXE
PID:2388

C:\Users\Admin\Documents\1zlTi_4caIdSFl2Y5tGvCh1a.exe
"C:\Users\Admin\Documents\1zlTi_4caIdSFl2Y5tGvCh1a.exe"
6⤵
- Executes dropped EXE
PID:2372

C:\Users\Admin\Documents\TZWSGZ0DEcbnZNLPHNNjnFLp.exe
"C:\Users\Admin\Documents\TZWSGZ0DEcbnZNLPHNNjnFLp.exe"
6⤵
PID:2112

C:\Users\Admin\Documents\TZWSGZ0DEcbnZNLPHNNjnFLp.exe
"C:\Users\Admin\Documents\TZWSGZ0DEcbnZNLPHNNjnFLp.exe"
7⤵
- Executes dropped EXE
PID:2460

C:\Users\Admin\Documents\P0cQjjj93zyoHXmWai3HXJKY.exe
"C:\Users\Admin\Documents\P0cQjjj93zyoHXmWai3HXJKY.exe"
6⤵
- Executes dropped EXE
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 572
7⤵
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
PID:3528

C:\Users\Admin\Documents\qj8cBGQEt4svrFloCnQuQFxN.exe
"C:\Users\Admin\Documents\qj8cBGQEt4svrFloCnQuQFxN.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:916

C:\Program Files (x86)\Company\NewProduct\inst001.exe
"C:\Program Files (x86)\Company\NewProduct\inst001.exe"
7⤵
- Executes dropped EXE
PID:3496

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
7⤵
- Executes dropped EXE
PID:3488

C:\Program Files (x86)\Company\NewProduct\cm3.exe
"C:\Program Files (x86)\Company\NewProduct\cm3.exe"
7⤵
- Executes dropped EXE
PID:3480

C:\Users\Admin\Documents\fIC33c6ZdEnjehRgoe16bFLS.exe
"C:\Users\Admin\Documents\fIC33c6ZdEnjehRgoe16bFLS.exe"
6⤵
- Executes dropped EXE
PID:1576

C:\Users\Admin\Documents\o5u0HYgVHJc71luDe8bfziB4.exe
"C:\Users\Admin\Documents\o5u0HYgVHJc71luDe8bfziB4.exe"
6⤵
- Executes dropped EXE
PID:1572

C:\Users\Admin\Documents\GM7CES7sHyORqJYKw5CwsFYP.exe
"C:\Users\Admin\Documents\GM7CES7sHyORqJYKw5CwsFYP.exe"
6⤵
- Executes dropped EXE
PID:756

C:\Users\Admin\Documents\C8LAeBdnLzA7abGr5CMnCHd9.exe
"C:\Users\Admin\Documents\C8LAeBdnLzA7abGr5CMnCHd9.exe"
6⤵
- Executes dropped EXE
PID:2652

C:\Users\Admin\Documents\jZcipOy5FuEhLdNkiZv51cls.exe
"C:\Users\Admin\Documents\jZcipOy5FuEhLdNkiZv51cls.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:828

C:\Users\Admin\Documents\jZcipOy5FuEhLdNkiZv51cls.exe
C:\Users\Admin\Documents\jZcipOy5FuEhLdNkiZv51cls.exe
7⤵
- Executes dropped EXE
PID:3224

C:\Users\Admin\Documents\_1cHOL73ZihACwWP8sv1GqAE.exe
"C:\Users\Admin\Documents\_1cHOL73ZihACwWP8sv1GqAE.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Users\Admin\Documents\uVSCfwElvjSxTk7K5zfFAOap.exe
"C:\Users\Admin\Documents\uVSCfwElvjSxTk7K5zfFAOap.exe"
6⤵
- Executes dropped EXE
PID:2280

C:\Users\Admin\Documents\AYGadg3ozjE9GpmcEVB8HabD.exe
"C:\Users\Admin\Documents\AYGadg3ozjE9GpmcEVB8HabD.exe"
6⤵
- Executes dropped EXE
PID:1736

C:\Users\Admin\Documents\HgppZGbHaX6cI50gDkW7gE7V.exe
"C:\Users\Admin\Documents\HgppZGbHaX6cI50gDkW7gE7V.exe"
6⤵
- Executes dropped EXE
PID:2500

C:\Users\Admin\Documents\oMkQxkiFta658SwJs349i18d.exe
"C:\Users\Admin\Documents\oMkQxkiFta658SwJs349i18d.exe"
6⤵
- Executes dropped EXE
PID:2228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "oMkQxkiFta658SwJs349i18d.exe" /f & erase "C:\Users\Admin\Documents\oMkQxkiFta658SwJs349i18d.exe" & exit
7⤵
PID:3356

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "oMkQxkiFta658SwJs349i18d.exe" /f
8⤵
- Kills process with taskkill
PID:4928

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed221ce23cd2c4a6.exe
4⤵
- Loads dropped DLL
PID:1488

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed221ce23cd2c4a6.exe
Wed221ce23cd2c4a6.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540

C:\Users\Admin\AppData\Local\Temp\is-T07RA.tmp\Wed221ce23cd2c4a6.tmp
"C:\Users\Admin\AppData\Local\Temp\is-T07RA.tmp\Wed221ce23cd2c4a6.tmp" /SL5="$60134,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed221ce23cd2c4a6.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320

C:\Users\Admin\AppData\Local\Temp\is-QJU31.tmp\___YHDG34.exe
"C:\Users\Admin\AppData\Local\Temp\is-QJU31.tmp\___YHDG34.exe" /S /UID=burnerch2
7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2424

C:\Program Files\DVD Maker\XUTJAHOPZT\ultramediaburner.exe
"C:\Program Files\DVD Maker\XUTJAHOPZT\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
PID:2672

C:\Users\Admin\AppData\Local\Temp\0e-ecd7c-668-d8cb6-884a8e921418f\Jexanigeme.exe
"C:\Users\Admin\AppData\Local\Temp\0e-ecd7c-668-d8cb6-884a8e921418f\Jexanigeme.exe"
8⤵
- Executes dropped EXE
PID:272

C:\Users\Admin\AppData\Local\Temp\c6-cf342-fdd-05fbf-e69ef5da546ea\Kunasebyfy.exe
"C:\Users\Admin\AppData\Local\Temp\c6-cf342-fdd-05fbf-e69ef5da546ea\Kunasebyfy.exe"
8⤵
- Executes dropped EXE
PID:2140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2744

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
10⤵
PID:3504

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:284

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:284 CREDAT:275457 /prefetch:2
10⤵
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4140 CREDAT:275457 /prefetch:2
10⤵
PID:4376

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4164 CREDAT:275457 /prefetch:2
10⤵
PID:4512

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4644 CREDAT:275457 /prefetch:2
10⤵
PID:4688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
9⤵
PID:3776

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3776 CREDAT:275457 /prefetch:2
10⤵
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?id=1294231
9⤵
PID:2096

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
10⤵
PID:2172

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1492888&var=3
9⤵
PID:2116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed222a0abb0f39640f.exe
4⤵
- Loads dropped DLL
PID:1792

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed222a0abb0f39640f.exe
Wed222a0abb0f39640f.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 956
6⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed224b216a9b264.exe
4⤵
- Loads dropped DLL
PID:916

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed224b216a9b264.exe
Wed224b216a9b264.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed22d29285f2462824d.exe /mixone
4⤵
- Loads dropped DLL
PID:592

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed22d29285f2462824d.exe
Wed22d29285f2462824d.exe /mixone
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Wed22d29285f2462824d.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed22d29285f2462824d.exe" & exit
6⤵
PID:3036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed226b6e8b18c18b003.exe
4⤵
- Loads dropped DLL
PID:1800

C:\Users\Admin\AppData\Local\Temp\7zS86592933\Wed226b6e8b18c18b003.exe
Wed226b6e8b18c18b003.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:816

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2644

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:2664

C:\Users\Admin\AppData\Local\Temp\65B4.exe
C:\Users\Admin\AppData\Local\Temp\65B4.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Users\Admin\AppData\Local\Temp\A708.exe
C:\Users\Admin\AppData\Local\Temp\A708.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2112

C:\Users\Admin\AppData\Local\Temp\A708.exe
C:\Users\Admin\AppData\Local\Temp\A708.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3384

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\40a31da1-c186-4fed-9849-d7ca69d7191c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:1632

C:\Users\Admin\AppData\Local\Temp\A708.exe
"C:\Users\Admin\AppData\Local\Temp\A708.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3888

C:\Users\Admin\AppData\Local\Temp\A708.exe
"C:\Users\Admin\AppData\Local\Temp\A708.exe" --Admin IsNotAutoStart IsNotTask
4⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 528
5⤵
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
PID:3876

C:\Users\Admin\AppData\Local\Temp\C6D9.exe
C:\Users\Admin\AppData\Local\Temp\C6D9.exe
1⤵
- Executes dropped EXE
PID:2356

C:\Users\Admin\AppData\Local\Temp\FE00.exe
C:\Users\Admin\AppData\Local\Temp\FE00.exe
1⤵
- Executes dropped EXE
PID:3116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\FE00.exe"
2⤵
PID:4400

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:4528

C:\Users\Admin\AppData\Local\Temp\75DE.exe
C:\Users\Admin\AppData\Local\Temp\75DE.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3364

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core
1⤵
PID:3404

C:\Windows\system32\taskeng.exe
taskeng.exe {5B18176D-9CF7-423C-A178-BCFC109EF794} S-1-5-21-2375386074-2889020035-839874990-1000:AFOWCZMM\Admin:Interactive:[1]
1⤵
PID:3176

C:\Users\Admin\AppData\Roaming\tsbiusi
C:\Users\Admin\AppData\Roaming\tsbiusi
2⤵
- Executes dropped EXE
PID:3280

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:2956

C:\Users\Admin\AppData\Local\40a31da1-c186-4fed-9849-d7ca69d7191c\A708.exe
C:\Users\Admin\AppData\Local\40a31da1-c186-4fed-9849-d7ca69d7191c\A708.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:3792

C:\Users\Admin\AppData\Local\40a31da1-c186-4fed-9849-d7ca69d7191c\A708.exe
C:\Users\Admin\AppData\Local\40a31da1-c186-4fed-9849-d7ca69d7191c\A708.exe --Task
3⤵
PID:1524

C:\Users\Admin\AppData\Local\Temp\1A0A.exe
C:\Users\Admin\AppData\Local\Temp\1A0A.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2584

C:\Users\Admin\AppData\Local\Temp\941A.exe
C:\Users\Admin\AppData\Local\Temp\941A.exe
1⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\C6DE.exe
C:\Users\Admin\AppData\Local\Temp\C6DE.exe
1⤵
PID:2168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\C6DE.exe"
2⤵
PID:4776

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:4924

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
1⤵
PID:4272

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
PID:4612

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

System Information Discovery