redline | 5967f1aef118ddfcd1d14d5cf3f29a62a845052c9ed9ce91587c0015b1047c58

System Information Discovery

Processes:

0PPLQpIBUwKwr5MST5TgmRpj.exeX56Y3hqcGEh2s3VWKHh28XQQ.exe8696538.scr

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0PPLQpIBUwKwr5MST5TgmRpj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0PPLQpIBUwKwr5MST5TgmRpj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	X56Y3hqcGEh2s3VWKHh28XQQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	X56Y3hqcGEh2s3VWKHh28XQQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8696538.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8696538.scr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Sat20ecdfe3ee79f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Control Panel\International\Geo\Nation	Sat20ecdfe3ee79f.exe

Loads dropped DLL 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exeSat20ecdfe3ee79f.execmd.exeSat20627fa1c49.execmd.execmd.exeSat20de8d8504.execmd.exeSat2026ef0d60b87a3f5.execmd.exeSat20545a92617f.exeSat20fbae42a4.exeSat200240b71b.execmd.exeSat20fbae42a4.tmpALRq6GW_MRwuGZDnjCzCJxxU.exe

pid	process
800	setup_x86_x64_install.exe
772	setup_installer.exe
772	setup_installer.exe
772	setup_installer.exe
772	setup_installer.exe
772	setup_installer.exe
772	setup_installer.exe
1132	setup_install.exe
1132	setup_install.exe
1132	setup_install.exe
1132	setup_install.exe
1132	setup_install.exe
1132	setup_install.exe
1132	setup_install.exe
1132	setup_install.exe
1680	cmd.exe
1372	cmd.exe
1856	cmd.exe
1500	cmd.exe
1500	cmd.exe
528	cmd.exe
528	cmd.exe
1620	cmd.exe
1620	cmd.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1624	cmd.exe
1624	cmd.exe
1304	Sat20627fa1c49.exe
1304	Sat20627fa1c49.exe
1196	cmd.exe
1540	cmd.exe
1668	Sat20de8d8504.exe
1588	cmd.exe
1668	Sat20de8d8504.exe
1588	cmd.exe
1188	Sat2026ef0d60b87a3f5.exe
1188	Sat2026ef0d60b87a3f5.exe
1256	cmd.exe
844	Sat20545a92617f.exe
844	Sat20545a92617f.exe
1172	Sat20fbae42a4.exe
1172	Sat20fbae42a4.exe
1804	Sat200240b71b.exe
1804	Sat200240b71b.exe
1512	cmd.exe
1172	Sat20fbae42a4.exe
924	Sat20fbae42a4.tmp
924	Sat20fbae42a4.tmp
924	Sat20fbae42a4.tmp
924	Sat20fbae42a4.tmp
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
2420	ALRq6GW_MRwuGZDnjCzCJxxU.exe
2420	ALRq6GW_MRwuGZDnjCzCJxxU.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

Ze2ro.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\MSBuild\\Paegetejumu.exe\""	Ze2ro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

0PPLQpIBUwKwr5MST5TgmRpj.exeX56Y3hqcGEh2s3VWKHh28XQQ.exe8696538.scr

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0PPLQpIBUwKwr5MST5TgmRpj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	X56Y3hqcGEh2s3VWKHh28XQQ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8696538.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com
30 ipinfo.io
31 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

0PPLQpIBUwKwr5MST5TgmRpj.exeX56Y3hqcGEh2s3VWKHh28XQQ.exe8696538.scr

pid process

2816 0PPLQpIBUwKwr5MST5TgmRpj.exe
2564 X56Y3hqcGEh2s3VWKHh28XQQ.exe
772 8696538.scr

flow	ioc
12	ip-api.com
30	ipinfo.io
31	ipinfo.io

pid	process
2816	0PPLQpIBUwKwr5MST5TgmRpj.exe
2564	X56Y3hqcGEh2s3VWKHh28XQQ.exe
772	8696538.scr

Suspicious use of SetThreadContext 2 IoCs

Processes:

Sat2026ef0d60b87a3f5.exetmpA8A_tmp.exe

description	pid	process	target process
PID 1188 set thread context of 3020	1188	Sat2026ef0d60b87a3f5.exe	Sat2026ef0d60b87a3f5.exe
PID 2068 set thread context of 2152	2068	tmpA8A_tmp.exe	tmpA8A_tmp.exe

Drops file in Program Files directory 4 IoCs

Processes:

Ze2ro.exe

description	ioc	process
File created	C:\Program Files (x86)\MSBuild\Paegetejumu.exe.config	Ze2ro.exe
File created	C:\Program Files\Google\HYSSCRIMMR\ultramediaburner.exe	Ze2ro.exe
File created	C:\Program Files\Google\HYSSCRIMMR\ultramediaburner.exe.config	Ze2ro.exe
File created	C:\Program Files (x86)\MSBuild\Paegetejumu.exe	Ze2ro.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 1804 WerFault.exe Sat200240b71b.exe

pid	pid_target	process	target process
2800	1804	WerFault.exe	Sat200240b71b.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Sat20de8d8504.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat20de8d8504.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat20de8d8504.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat20de8d8504.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3200 timeout.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2036 taskkill.exe
3188 taskkill.exe

pid	process
3200	timeout.exe

pid	process
2036	taskkill.exe
3188	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F21DD20-18CB-11EC-A5C2-465E4337BA99} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0cf3de2821c1b4396907f218d77eb08000000000200000000001066000000010000200000005b62a9853a69c005f87c2af50e838c7e2975f411d76240d85f450f987c588cec000000000e80000000020000200000006c9a33df536313b7f0578d4c3685f4fcc80e6197254f0b2de1fc46ffc6ba9f3c9000000096cf155a635e61a0dd230eedb468a35d8955608fca9a13ca9e039d29dc7d698f6e72e46541f3a900b05ff90edde7efd342c5c1ddf05dab50b2ac6490365e46dbeaeb36d986f4cc858c860b8f861f459c7f197c3a0146d5d60231312b6433c5f713b25da4b4719c243beb70f5c23d295725e83c306693adf498dd82917913201f5d79193b69137b17b7f9f5add7638c474000000026d75af22b8de61b938f26082fe3f667ae7d87e998d57c04c144667f74a168fa7e0ecdd300977bbb93c7fdf35254e76c5a021f227a16594df1a074303edb5f2d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AFCF180-18C8-11EC-A5C2-465E4337BA99} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7FE8140-18C9-11EC-A5C2-465E4337BA99} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D23CE00-18C9-11EC-A5C2-465E4337BA99} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0cf3de2821c1b4396907f218d77eb08000000000200000000001066000000010000200000001f24a93bb305f57d2746ff4b793613cb1b7ee943e89e6b1127b28e32f9b632c9000000000e80000000020000200000000a5180cae392f3b0beb6698d8c42d86f197925aaefe91c3059f017ee1d924c8d20000000528fac8fe9bac9bddca14d4fe1e35e2f953fa15113ef3d050f5e830aea6bb08a4000000025ecb062b042d1d28fb3a09e3888422e5f329725bf40c7c1789c1d113bca8a9400ac9604f72e65c508aadf46511b088d1a3f67db8f4e212b6ac0a11ca5533577	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Sat20ecdfe3ee79f.exeSat20ed203af5.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sat20ecdfe3ee79f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sat20ecdfe3ee79f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sat20ed203af5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sat20ed203af5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sat20ecdfe3ee79f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sat20de8d8504.exeSat20ecdfe3ee79f.exeHH9Ts2cd4oO7l3P1_6TKpykt.exe

pid	process
1668	Sat20de8d8504.exe
1668	Sat20de8d8504.exe
1392
1392
1392
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1392
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1440	Sat20ecdfe3ee79f.exe
1392
1392
1392
1392
1392
1392
1392
1392
1392
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
1392
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
1392
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
1392
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
1392
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe
1392
2220	HH9Ts2cd4oO7l3P1_6TKpykt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1392
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Sat20de8d8504.exe

pid process

1668 Sat20de8d8504.exe

pid	process
1392

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

Sat20ed203af5.exepowershell.exeSat2071d99516dc03841.exeGoogleUpdate.exeX56Y3hqcGEh2s3VWKHh28XQQ.exeF2B8.exeEE39.exe

description	pid	process
Token: SeDebugPrivilege	2004	Sat20ed203af5.exe
Token: SeDebugPrivilege	596	powershell.exe
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeDebugPrivilege	1688	Sat2071d99516dc03841.exe
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeDebugPrivilege	2972	GoogleUpdate.exe
Token: SeDebugPrivilege	2972	GoogleUpdate.exe
Token: SeDebugPrivilege	2972	GoogleUpdate.exe
Token: SeDebugPrivilege	2564	X56Y3hqcGEh2s3VWKHh28XQQ.exe
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeDebugPrivilege	2476	F2B8.exe
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeDebugPrivilege	2984	EE39.exe
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1392
1392
2168 iexplore.exe
1392
1392
3084 iexplore.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1392
1392

pid	process
1392
1392
2168	iexplore.exe
1392
1392
3084	iexplore.exe

pid	process
1392
1392

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exe

pid	process
2168	iexplore.exe
2168	iexplore.exe
1172	IEXPLORE.EXE
1172	IEXPLORE.EXE
2748	iexplore.exe
2748	iexplore.exe
540	iexplore.exe
540	iexplore.exe
3084	iexplore.exe
3084	iexplore.exe
3344	IEXPLORE.EXE
3344	IEXPLORE.EXE
2168	iexplore.exe
2168	iexplore.exe
3852	iexplore.exe
3852	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.exe

description	pid	process	target process
PID 800 wrote to memory of 772	800	setup_x86_x64_install.exe	setup_installer.exe
PID 800 wrote to memory of 772	800	setup_x86_x64_install.exe	setup_installer.exe
PID 800 wrote to memory of 772	800	setup_x86_x64_install.exe	setup_installer.exe
PID 800 wrote to memory of 772	800	setup_x86_x64_install.exe	setup_installer.exe
PID 800 wrote to memory of 772	800	setup_x86_x64_install.exe	setup_installer.exe
PID 800 wrote to memory of 772	800	setup_x86_x64_install.exe	setup_installer.exe
PID 800 wrote to memory of 772	800	setup_x86_x64_install.exe	setup_installer.exe
PID 772 wrote to memory of 1132	772	setup_installer.exe	setup_install.exe
PID 772 wrote to memory of 1132	772	setup_installer.exe	setup_install.exe
PID 772 wrote to memory of 1132	772	setup_installer.exe	setup_install.exe
PID 772 wrote to memory of 1132	772	setup_installer.exe	setup_install.exe
PID 772 wrote to memory of 1132	772	setup_installer.exe	setup_install.exe
PID 772 wrote to memory of 1132	772	setup_installer.exe	setup_install.exe
PID 772 wrote to memory of 1132	772	setup_installer.exe	setup_install.exe
PID 1132 wrote to memory of 1404	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1404	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1404	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1404	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1404	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1404	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1404	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1680	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1680	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1680	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1680	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1680	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1680	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1680	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1372	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1372	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1372	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1372	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1372	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1372	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1372	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1256	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1256	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1256	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1256	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1256	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1256	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1256	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1540	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1540	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1540	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1540	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1540	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1540	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1540	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1856	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1856	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1856	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1856	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1856	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1856	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1856	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1836	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1836	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1836	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1836	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1836	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1836	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1836	1132	setup_install.exe	cmd.exe
PID 1132 wrote to memory of 1500	1132	setup_install.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:772

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
PID:1404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat20578e6239.exe
4⤵
- Loads dropped DLL
PID:1372

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20578e6239.exe
Sat20578e6239.exe
5⤵
PID:552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat20ecdfe3ee79f.exe
4⤵
- Loads dropped DLL
PID:1680

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20ecdfe3ee79f.exe
Sat20ecdfe3ee79f.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1440

C:\Users\Admin\Documents\HH9Ts2cd4oO7l3P1_6TKpykt.exe
"C:\Users\Admin\Documents\HH9Ts2cd4oO7l3P1_6TKpykt.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2220

C:\Users\Admin\Documents\ALRq6GW_MRwuGZDnjCzCJxxU.exe
"C:\Users\Admin\Documents\ALRq6GW_MRwuGZDnjCzCJxxU.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420

C:\Users\Admin\Documents\62gqINNcFY_DW4vxeeRSZxFw.exe
"C:\Users\Admin\Documents\62gqINNcFY_DW4vxeeRSZxFw.exe"
6⤵
- Executes dropped EXE
PID:2500

C:\Users\Admin\Documents\I4k45bh5ppIkSrtwDdIaShsx.exe
"C:\Users\Admin\Documents\I4k45bh5ppIkSrtwDdIaShsx.exe"
6⤵
- Executes dropped EXE
PID:2488

C:\Users\Admin\Documents\Lf9JLZpQqcvrFUMHiU2Lbbb0.exe
"C:\Users\Admin\Documents\Lf9JLZpQqcvrFUMHiU2Lbbb0.exe"
6⤵
- Executes dropped EXE
PID:2648

C:\Users\Admin\Documents\POrmwbkUSpZ3iY4XXC9kvNCU.exe
"C:\Users\Admin\Documents\POrmwbkUSpZ3iY4XXC9kvNCU.exe"
6⤵
- Executes dropped EXE
PID:2620

C:\Users\Admin\Documents\EdEmqHYmSKVCRT_7amjFoKqJ.exe
"C:\Users\Admin\Documents\EdEmqHYmSKVCRT_7amjFoKqJ.exe"
6⤵
- Executes dropped EXE
PID:2596

C:\Users\Admin\Documents\sxAtmdTraaCwx6oyqp76p7ki.exe
"C:\Users\Admin\Documents\sxAtmdTraaCwx6oyqp76p7ki.exe"
6⤵
- Executes dropped EXE
PID:2580

C:\Users\Admin\Documents\X56Y3hqcGEh2s3VWKHh28XQQ.exe
"C:\Users\Admin\Documents\X56Y3hqcGEh2s3VWKHh28XQQ.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Users\Admin\Documents\NORKamwalSWpvpDtzAnlCFy7.exe
"C:\Users\Admin\Documents\NORKamwalSWpvpDtzAnlCFy7.exe"
6⤵
PID:2556

C:\Users\Admin\Documents\WqavxrNdpiKjVRxGRipcXhd4.exe
"C:\Users\Admin\Documents\WqavxrNdpiKjVRxGRipcXhd4.exe"
6⤵
- Executes dropped EXE
PID:2548

C:\Users\Admin\Documents\NFEFUoAuQuaLevogKXdlfS_N.exe
"C:\Users\Admin\Documents\NFEFUoAuQuaLevogKXdlfS_N.exe"
6⤵
- Executes dropped EXE
PID:2536

C:\Users\Admin\Documents\ToFF9jeyQQ5RyW7Vxa6iG03Q.exe
"C:\Users\Admin\Documents\ToFF9jeyQQ5RyW7Vxa6iG03Q.exe"
6⤵
- Executes dropped EXE
PID:2524

C:\Users\Admin\Documents\EOCaX2mmulBuKZ_pLSTyCp40.exe
"C:\Users\Admin\Documents\EOCaX2mmulBuKZ_pLSTyCp40.exe"
6⤵
PID:2512

C:\Users\Admin\Documents\0PPLQpIBUwKwr5MST5TgmRpj.exe
"C:\Users\Admin\Documents\0PPLQpIBUwKwr5MST5TgmRpj.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2816

C:\Users\Admin\Documents\CpM2ZvHcN507KfcWmPvAbUFd.exe
"C:\Users\Admin\Documents\CpM2ZvHcN507KfcWmPvAbUFd.exe"
6⤵
- Executes dropped EXE
PID:2764

C:\Users\Admin\Documents\o6QNtt9hFPsoGbA6Wfjma79x.exe
"C:\Users\Admin\Documents\o6QNtt9hFPsoGbA6Wfjma79x.exe"
6⤵
- Executes dropped EXE
PID:2752

C:\Users\Admin\Documents\oqAvmEGeXstefK4cAmF7uBw4.exe
"C:\Users\Admin\Documents\oqAvmEGeXstefK4cAmF7uBw4.exe"
6⤵
- Executes dropped EXE
PID:2740

C:\Users\Admin\Documents\mktj0vz3LYR1FJMnTBczBcfg.exe
"C:\Users\Admin\Documents\mktj0vz3LYR1FJMnTBczBcfg.exe"
6⤵
- Executes dropped EXE
PID:2712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "mktj0vz3LYR1FJMnTBczBcfg.exe" /f & erase "C:\Users\Admin\Documents\mktj0vz3LYR1FJMnTBczBcfg.exe" & exit
7⤵
PID:1164

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "mktj0vz3LYR1FJMnTBczBcfg.exe" /f
8⤵
- Kills process with taskkill
PID:3188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat2071d99516dc03841.exe
4⤵
- Loads dropped DLL
PID:1256

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat2071d99516dc03841.exe
Sat2071d99516dc03841.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Users\Admin\AppData\Local\Temp\tmpA8A_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpA8A_tmp.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2068

C:\Users\Admin\AppData\Local\Temp\tmpA8A_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmpA8A_tmp.exe
7⤵
- Executes dropped EXE
PID:2152

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat20fbae42a4.exe
4⤵
- Loads dropped DLL
PID:1540

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20fbae42a4.exe
Sat20fbae42a4.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172

C:\Users\Admin\AppData\Local\Temp\is-QB8SQ.tmp\Sat20fbae42a4.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QB8SQ.tmp\Sat20fbae42a4.tmp" /SL5="$6002E,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20fbae42a4.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924

C:\Users\Admin\AppData\Local\Temp\is-FQP2M.tmp\Ze2ro.exe
"C:\Users\Admin\AppData\Local\Temp\is-FQP2M.tmp\Ze2ro.exe" /S /UID=burnerch2
7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2148

C:\Program Files\Google\HYSSCRIMMR\ultramediaburner.exe
"C:\Program Files\Google\HYSSCRIMMR\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
PID:2104

C:\Users\Admin\AppData\Local\Temp\2e-5d5d4-004-b81bb-cf5ffd14ac406\Paefaecipaeta.exe
"C:\Users\Admin\AppData\Local\Temp\2e-5d5d4-004-b81bb-cf5ffd14ac406\Paefaecipaeta.exe"
8⤵
- Executes dropped EXE
PID:2704

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
9⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2168

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
10⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1172

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:1127447 /prefetch:2
10⤵
PID:3952

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
9⤵
PID:1624

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
10⤵
PID:2192

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:540

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:540 CREDAT:275457 /prefetch:2
10⤵
PID:1036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
9⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3084

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3084 CREDAT:275457 /prefetch:2
10⤵
- Suspicious use of SetWindowsHookEx
PID:3344

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3852

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3852 CREDAT:275457 /prefetch:2
10⤵
PID:2356

C:\Users\Admin\AppData\Local\Temp\8e-04cda-0c3-dcaa2-946de6b0660f3\Vupajaebagae.exe
"C:\Users\Admin\AppData\Local\Temp\8e-04cda-0c3-dcaa2-946de6b0660f3\Vupajaebagae.exe"
8⤵
- Executes dropped EXE
PID:2844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat20873bc74eb80e0.exe
4⤵
- Loads dropped DLL
PID:1856

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20873bc74eb80e0.exe
Sat20873bc74eb80e0.exe
5⤵
- Executes dropped EXE
PID:944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat205eb4a2ece877a.exe
4⤵
PID:1836

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat205eb4a2ece877a.exe
Sat205eb4a2ece877a.exe
5⤵
PID:2608

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat20627fa1c49.exe
4⤵
- Loads dropped DLL
PID:1500

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20627fa1c49.exe
Sat20627fa1c49.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat20ed203af5.exe
4⤵
- Loads dropped DLL
PID:1196

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20ed203af5.exe
Sat20ed203af5.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Users\Admin\AppData\Roaming\1921765.scr
"C:\Users\Admin\AppData\Roaming\1921765.scr" /S
6⤵
- Executes dropped EXE
PID:1452

C:\Users\Admin\AppData\Roaming\2111388.scr
"C:\Users\Admin\AppData\Roaming\2111388.scr" /S
6⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\AppData\Roaming\8325946.scr
"C:\Users\Admin\AppData\Roaming\8325946.scr" /S
6⤵
- Executes dropped EXE
PID:2544

C:\Users\Admin\AppData\Roaming\8696538.scr
"C:\Users\Admin\AppData\Roaming\8696538.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:772

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat2077373f11706fb7.exe
4⤵
- Loads dropped DLL
PID:1512

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat2077373f11706fb7.exe
Sat2077373f11706fb7.exe
5⤵
- Executes dropped EXE
PID:780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat20545a92617f.exe /mixone
4⤵
- Loads dropped DLL
PID:1624

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20545a92617f.exe
Sat20545a92617f.exe /mixone
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Sat20545a92617f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20545a92617f.exe" & exit
6⤵
PID:2456

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Sat20545a92617f.exe" /f
7⤵
- Kills process with taskkill
PID:2036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat2026ef0d60b87a3f5.exe
4⤵
- Loads dropped DLL
PID:528

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat2026ef0d60b87a3f5.exe
Sat2026ef0d60b87a3f5.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1188

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat2026ef0d60b87a3f5.exe
C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat2026ef0d60b87a3f5.exe
6⤵
PID:3020

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat200240b71b.exe
4⤵
- Loads dropped DLL
PID:1588

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat200240b71b.exe
Sat200240b71b.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 932
6⤵
- Program crash
PID:2800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat20de8d8504.exe
4⤵
- Loads dropped DLL
PID:1620

C:\Users\Admin\AppData\Local\Temp\7zS4034CFD2\Sat20de8d8504.exe
Sat20de8d8504.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1668

C:\Users\Admin\AppData\Local\Temp\56E5.exe
C:\Users\Admin\AppData\Local\Temp\56E5.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Users\Admin\AppData\Local\Temp\F2B8.exe
C:\Users\Admin\AppData\Local\Temp\F2B8.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\taskeng.exe
taskeng.exe {6BA92BFA-71A7-493E-B066-578B58C23A8C} S-1-5-21-2375386074-2889020035-839874990-1000:AFOWCZMM\Admin:Interactive:[1]
1⤵
PID:2900

C:\Users\Admin\AppData\Roaming\wgctdei
C:\Users\Admin\AppData\Roaming\wgctdei
2⤵
- Executes dropped EXE
PID:296

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:1892

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
PID:3048

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
1⤵
PID:2940

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
1⤵
PID:2100

C:\Users\Admin\AppData\Local\Temp\B4EF.exe
C:\Users\Admin\AppData\Local\Temp\B4EF.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B4EF.exe"
2⤵
PID:3096

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:3200

C:\Users\Admin\AppData\Local\Temp\908E.exe
C:\Users\Admin\AppData\Local\Temp\908E.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Users\Admin\AppData\Local\Temp\EE39.exe
C:\Users\Admin\AppData\Local\Temp\EE39.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Users\Admin\AppData\Local\Temp\FECD.exe
C:\Users\Admin\AppData\Local\Temp\FECD.exe
1⤵
- Executes dropped EXE
PID:844

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery