glupteba | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

System Information Discovery

Processes:

2980158.exe6751911.scr3198603.scr1348514.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2980158.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2980158.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6751911.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6751911.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3198603.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3198603.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1348514.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1348514.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Sun1917b8fb5f09db8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Control Panel\International\Geo\Nation	Sun1917b8fb5f09db8.exe

Loads dropped DLL 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.exeSun1917b8fb5f09db8.execmd.execmd.execmd.execmd.exeSun1908b94df837b3158.exeSun19262b9e49ad.execmd.execmd.execmd.exeSun195a1614ec24e6a.exeSun1966fb31dd5a07.exeSun1966fb31dd5a07.tmpcmd.exeSun19de8ff4b6aefeb8.exeLzmwAqmV.exesetup.exeudptest.exesetup_2.exe3002.exe

pid	process
1064	setup_x86_x64_install.exe
564	setup_installer.exe
564	setup_installer.exe
564	setup_installer.exe
564	setup_installer.exe
564	setup_installer.exe
564	setup_installer.exe
1896	setup_install.exe
1896	setup_install.exe
1896	setup_install.exe
1896	setup_install.exe
1896	setup_install.exe
1896	setup_install.exe
1896	setup_install.exe
1896	setup_install.exe
1960	cmd.exe
1392	cmd.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
1528	cmd.exe
1696	cmd.exe
1908	cmd.exe
1908	cmd.exe
1028	cmd.exe
1668	Sun1908b94df837b3158.exe
1668	Sun1908b94df837b3158.exe
1660	Sun19262b9e49ad.exe
1644	cmd.exe
1660	Sun19262b9e49ad.exe
1812	cmd.exe
1632	cmd.exe
1860	Sun195a1614ec24e6a.exe
1860	Sun195a1614ec24e6a.exe
1100	Sun1966fb31dd5a07.exe
1100	Sun1966fb31dd5a07.exe
1100	Sun1966fb31dd5a07.exe
1768	Sun1966fb31dd5a07.tmp
1768	Sun1966fb31dd5a07.tmp
1768	Sun1966fb31dd5a07.tmp
1736	cmd.exe
1736	cmd.exe
2132	Sun19de8ff4b6aefeb8.exe
2132	Sun19de8ff4b6aefeb8.exe
1768	Sun1966fb31dd5a07.tmp
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2660	setup.exe
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2804	udptest.exe
2804	udptest.exe
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2412	setup_2.exe
2412	setup_2.exe
2380	LzmwAqmV.exe
2380	LzmwAqmV.exe
2412	setup_2.exe
2316	3002.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2840-242-0x00000000001B0000-0x00000000001B1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

Ze2ro.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Common Files\\Boragaejuda.exe\""	Ze2ro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

1348514.exe2980158.exe6751911.scr3198603.scr

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1348514.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2980158.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6751911.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3198603.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com
40 ipinfo.io
41 ipinfo.io
1005 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

6751911.scr3198603.scr1348514.exe2980158.exe

pid process

2600 6751911.scr
2840 3198603.scr
3476 1348514.exe
3896 2980158.exe

flow	ioc
12	ip-api.com
40	ipinfo.io
41	ipinfo.io
1005	ip-api.com

pid	process
2600	6751911.scr
2840	3198603.scr
3476	1348514.exe
3896	2980158.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

8260557.scrtaskkill.exe1218012.exeservices64.exe

description	pid	process	target process
PID 2692 set thread context of 2524	2692	8260557.scr	8260557.scr
PID 1752 set thread context of 3564	1752	taskkill.exe	explorer.exe
PID 3664 set thread context of 4016	3664	1218012.exe	1218012.exe
PID 4088 set thread context of 1236	4088	services64.exe	explorer.exe

Drops file in Program Files directory 12 IoCs

Processes:

ultramediaburner.tmpZe2ro.exesetup_2.tmp

description	ioc	process
File created	C:\Program Files (x86)\UltraMediaBurner\is-I2TL9.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\Common Files\Boragaejuda.exe	Ze2ro.exe
File created	C:\Program Files (x86)\Common Files\Boragaejuda.exe.config	Ze2ro.exe
File created	C:\Program Files\Uninstall Information\QCUQJISSCS\ultramediaburner.exe	Ze2ro.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files\Uninstall Information\QCUQJISSCS\ultramediaburner.exe.config	Ze2ro.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-BVLHH.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-1DGTN.tmp	setup_2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1564	2692	WerFault.exe	8260557.scr
3416	2928	WerFault.exe	5.exe
3596	1716	WerFault.exe	Sun198361825f4.exe
3588	996	WerFault.exe	LivelyScreenRecF18.exe
3712	332	WerFault.exe	Sun1917b8fb5f09db8.exe
4040	3664	WerFault.exe	1218012.exe
2800	3564	WerFault.exe	explorer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Sun1908b94df837b3158.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3312 schtasks.exe
1168 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3016 timeout.exe
Kills process with taskkill 6 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2108 taskkill.exe
1724 taskkill.exe
2188 taskkill.exe
1752 taskkill.exe
2552 taskkill.exe
2844 taskkill.exe

pid	process
3312	schtasks.exe
1168	schtasks.exe

pid	process
3016	timeout.exe

pid	process
2108	taskkill.exe
1724	taskkill.exe
2188	taskkill.exe
1752	taskkill.exe
2552	taskkill.exe
2844	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DEC10890-1988-11EC-A19F-623C374619D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies system certificate store 2 TTPs 13 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Jozhapygoce.exeSun19262b9e49ad.exe6086468.exeSun191101c1aaa.exeSun19e4ade31b2a.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Jozhapygoce.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Jozhapygoce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Sun19262b9e49ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Sun19262b9e49ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	6086468.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	6086468.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Jozhapygoce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	6086468.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun191101c1aaa.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun191101c1aaa.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun191101c1aaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun19e4ade31b2a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun19e4ade31b2a.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 75 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	75	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sun1908b94df837b3158.exeSun1917b8fb5f09db8.exe

pid	process
1668	Sun1908b94df837b3158.exe
1668	Sun1908b94df837b3158.exe
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
1448
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe
332	Sun1917b8fb5f09db8.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

WerFault.exe

pid process

1448
1564 WerFault.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Sun1908b94df837b3158.exe

pid process

1668 Sun1908b94df837b3158.exe

pid	process
1448
1564	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sun19262b9e49ad.exeSun19e4ade31b2a.exeSun191101c1aaa.exe8524715.scrSun195a1614ec24e6a.exe6086468.execmd.exepowershell.exe5.exe8260557.scrtaskkill.exeCC46.exeBearVpn 3.exe3198603.scr

description	pid	process
Token: SeCreateTokenPrivilege	1660	Sun19262b9e49ad.exe
Token: SeAssignPrimaryTokenPrivilege	1660	Sun19262b9e49ad.exe
Token: SeLockMemoryPrivilege	1660	Sun19262b9e49ad.exe
Token: SeIncreaseQuotaPrivilege	1660	Sun19262b9e49ad.exe
Token: SeMachineAccountPrivilege	1660	Sun19262b9e49ad.exe
Token: SeTcbPrivilege	1660	Sun19262b9e49ad.exe
Token: SeSecurityPrivilege	1660	Sun19262b9e49ad.exe
Token: SeTakeOwnershipPrivilege	1660	Sun19262b9e49ad.exe
Token: SeLoadDriverPrivilege	1660	Sun19262b9e49ad.exe
Token: SeSystemProfilePrivilege	1660	Sun19262b9e49ad.exe
Token: SeSystemtimePrivilege	1660	Sun19262b9e49ad.exe
Token: SeProfSingleProcessPrivilege	1660	Sun19262b9e49ad.exe
Token: SeIncBasePriorityPrivilege	1660	Sun19262b9e49ad.exe
Token: SeCreatePagefilePrivilege	1660	Sun19262b9e49ad.exe
Token: SeCreatePermanentPrivilege	1660	Sun19262b9e49ad.exe
Token: SeBackupPrivilege	1660	Sun19262b9e49ad.exe
Token: SeRestorePrivilege	1660	Sun19262b9e49ad.exe
Token: SeShutdownPrivilege	1660	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	1660	Sun19262b9e49ad.exe
Token: SeAuditPrivilege	1660	Sun19262b9e49ad.exe
Token: SeSystemEnvironmentPrivilege	1660	Sun19262b9e49ad.exe
Token: SeChangeNotifyPrivilege	1660	Sun19262b9e49ad.exe
Token: SeRemoteShutdownPrivilege	1660	Sun19262b9e49ad.exe
Token: SeUndockPrivilege	1660	Sun19262b9e49ad.exe
Token: SeSyncAgentPrivilege	1660	Sun19262b9e49ad.exe
Token: SeEnableDelegationPrivilege	1660	Sun19262b9e49ad.exe
Token: SeManageVolumePrivilege	1660	Sun19262b9e49ad.exe
Token: SeImpersonatePrivilege	1660	Sun19262b9e49ad.exe
Token: SeCreateGlobalPrivilege	1660	Sun19262b9e49ad.exe
Token: 31	1660	Sun19262b9e49ad.exe
Token: 32	1660	Sun19262b9e49ad.exe
Token: 33	1660	Sun19262b9e49ad.exe
Token: 34	1660	Sun19262b9e49ad.exe
Token: 35	1660	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	1524	Sun19e4ade31b2a.exe
Token: SeDebugPrivilege	1404	Sun191101c1aaa.exe
Token: SeShutdownPrivilege	1448
Token: SeDebugPrivilege	2392	8524715.scr
Token: SeShutdownPrivilege	1448
Token: SeDebugPrivilege	1860	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	2588	6086468.exe
Token: SeShutdownPrivilege	1448
Token: SeDebugPrivilege	2540	cmd.exe
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeShutdownPrivilege	1448
Token: SeDebugPrivilege	2928	5.exe
Token: SeShutdownPrivilege	1448
Token: SeDebugPrivilege	2692	8260557.scr
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeShutdownPrivilege	1448
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeShutdownPrivilege	1448
Token: SeDebugPrivilege	1724	CC46.exe
Token: SeDebugPrivilege	2812	BearVpn 3.exe
Token: SeDebugPrivilege	2840	3198603.scr

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

setup_2.tmpultramediaburner.tmpiexplore.exe

pid process

1448
1448
2064 setup_2.tmp
3440 ultramediaburner.tmp
3364 iexplore.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

pid process

1448
1448
1448
1448
1448
1448
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3364 iexplore.exe
3364 iexplore.exe
2792 IEXPLORE.EXE
2792 IEXPLORE.EXE

pid	process
1448
1448
2064	setup_2.tmp
3440	ultramediaburner.tmp
3364	iexplore.exe

pid	process
1448
1448
1448
1448
1448
1448

pid	process
3364	iexplore.exe
3364	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.exe

description	pid	process	target process
PID 1064 wrote to memory of 564	1064	setup_x86_x64_install.exe	setup_installer.exe
PID 1064 wrote to memory of 564	1064	setup_x86_x64_install.exe	setup_installer.exe
PID 1064 wrote to memory of 564	1064	setup_x86_x64_install.exe	setup_installer.exe
PID 1064 wrote to memory of 564	1064	setup_x86_x64_install.exe	setup_installer.exe
PID 1064 wrote to memory of 564	1064	setup_x86_x64_install.exe	setup_installer.exe
PID 1064 wrote to memory of 564	1064	setup_x86_x64_install.exe	setup_installer.exe
PID 1064 wrote to memory of 564	1064	setup_x86_x64_install.exe	setup_installer.exe
PID 564 wrote to memory of 1896	564	setup_installer.exe	setup_install.exe
PID 564 wrote to memory of 1896	564	setup_installer.exe	setup_install.exe
PID 564 wrote to memory of 1896	564	setup_installer.exe	setup_install.exe
PID 564 wrote to memory of 1896	564	setup_installer.exe	setup_install.exe
PID 564 wrote to memory of 1896	564	setup_installer.exe	setup_install.exe
PID 564 wrote to memory of 1896	564	setup_installer.exe	setup_install.exe
PID 564 wrote to memory of 1896	564	setup_installer.exe	setup_install.exe
PID 1896 wrote to memory of 1388	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1388	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1388	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1388	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1388	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1388	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1388	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1392	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1392	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1392	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1392	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1392	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1392	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1392	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1696	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1696	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1696	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1696	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1696	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1696	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1696	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1528	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1528	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1528	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1528	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1528	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1528	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1528	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1960	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1960	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1960	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1960	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1960	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1960	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1960	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1908	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1908	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1908	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1908	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1908	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1908	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1908	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1736	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1736	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1736	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1736	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1736	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1736	1896	setup_install.exe	cmd.exe
PID 1896 wrote to memory of 1736	1896	setup_install.exe	cmd.exe
PID 1388 wrote to memory of 1612	1388	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:564

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS432868E2\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
4⤵
- Loads dropped DLL
PID:1392

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun1917b8fb5f09db8.exe
Sun1917b8fb5f09db8.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:332

C:\Users\Admin\Documents\uoOxnOKyDcka2slCD457zBQw.exe
"C:\Users\Admin\Documents\uoOxnOKyDcka2slCD457zBQw.exe"
6⤵
- Executes dropped EXE
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 1512
6⤵
- Program crash
PID:3712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
4⤵
- Loads dropped DLL
PID:1696

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun19262b9e49ad.exe
Sun19262b9e49ad.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:3028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
4⤵
- Loads dropped DLL
PID:1528

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun193fda712d9f1.exe
Sun193fda712d9f1.exe
5⤵
- Executes dropped EXE
PID:800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
4⤵
- Loads dropped DLL
PID:1960

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun19e4ade31b2a.exe
Sun19e4ade31b2a.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Users\Admin\AppData\Roaming\8524715.scr
"C:\Users\Admin\AppData\Roaming\8524715.scr" /S
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Users\Admin\AppData\Roaming\6751911.scr
"C:\Users\Admin\AppData\Roaming\6751911.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2600

C:\Users\Admin\AppData\Roaming\8260557.scr
"C:\Users\Admin\AppData\Roaming\8260557.scr" /S
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Users\Admin\AppData\Roaming\8260557.scr
"C:\Users\Admin\AppData\Roaming\8260557.scr"
7⤵
- Executes dropped EXE
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 764
7⤵
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
PID:1564

C:\Users\Admin\AppData\Roaming\3198603.scr
"C:\Users\Admin\AppData\Roaming\3198603.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
4⤵
- Loads dropped DLL
PID:1908

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun1908b94df837b3158.exe
Sun1908b94df837b3158.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
4⤵
- Loads dropped DLL
PID:1736

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun19de8ff4b6aefeb8.exe
Sun19de8ff4b6aefeb8.exe /mixone
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Sun19de8ff4b6aefeb8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun19de8ff4b6aefeb8.exe" & exit
6⤵
PID:3060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Sun19de8ff4b6aefeb8.exe" /f
7⤵
- Kills process with taskkill
PID:1724

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
4⤵
- Loads dropped DLL
PID:1028

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun191101c1aaa.exe
Sun191101c1aaa.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
7⤵
- Executes dropped EXE
PID:2488

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
8⤵
PID:3232

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
9⤵
- Creates scheduled task(s)
PID:3312

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4088

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:2716

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:1168

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
9⤵
- Executes dropped EXE
PID:2764

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
9⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
7⤵
PID:2540

C:\ProgramData\6086468.exe
"C:\ProgramData\6086468.exe"
8⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\ProgramData\1348514.exe
"C:\ProgramData\1348514.exe"
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3476

C:\ProgramData\1218012.exe
"C:\ProgramData\1218012.exe"
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3664

C:\ProgramData\1218012.exe
"C:\ProgramData\1218012.exe"
9⤵
- Executes dropped EXE
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 768
9⤵
- Program crash
PID:4040

C:\ProgramData\2980158.exe
"C:\ProgramData\2980158.exe"
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3896

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
7⤵
PID:2588

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
9⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
8⤵
PID:2700

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "setup.exe" /f
9⤵
- Kills process with taskkill
PID:2188

C:\Users\Admin\AppData\Local\Temp\udptest.exe
"C:\Users\Admin\AppData\Local\Temp\udptest.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2928 -s 1432
8⤵
- Program crash
PID:3416

C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
7⤵
- Executes dropped EXE
PID:996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 996 -s 800
8⤵
- Program crash
PID:3588

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412

C:\Users\Admin\AppData\Local\Temp\is-G255B.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-G255B.tmp\setup_2.tmp" /SL5="$401F0,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
8⤵
- Executes dropped EXE
PID:2432

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
9⤵
- Executes dropped EXE
PID:2576

C:\Users\Admin\AppData\Local\Temp\is-BVKCP.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BVKCP.tmp\setup_2.tmp" /SL5="$401F2,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
10⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:2064

C:\Users\Admin\AppData\Local\Temp\is-FI6DT.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-FI6DT.tmp\postback.exe" ss1
11⤵
PID:1752

C:\Windows\SysWOW64\explorer.exe
explorer.exe ss1
12⤵
PID:3564

C:\Windows\SysWOW64\cmd.exe
cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\nYaD8ePes.dll"
13⤵
PID:2848

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\nYaD8ePes.dll"
14⤵
PID:3848

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\nYaD8ePes.dll"
15⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 908
13⤵
- Program crash
PID:2800

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
8⤵
PID:1136

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
PID:2092

C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
4⤵
PID:592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
4⤵
- Loads dropped DLL
PID:1632

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun198361825f4.exe
Sun198361825f4.exe
5⤵
- Executes dropped EXE
PID:1716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1716 -s 808
6⤵
- Program crash
PID:3596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
4⤵
PID:1980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
4⤵
- Loads dropped DLL
PID:1812

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun195a1614ec24e6a.exe
Sun195a1614ec24e6a.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
4⤵
- Loads dropped DLL
PID:1644

C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun1966fb31dd5a07.exe
Sun1966fb31dd5a07.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100

C:\Users\Admin\AppData\Local\Temp\is-I4V94.tmp\Sun1966fb31dd5a07.tmp
"C:\Users\Admin\AppData\Local\Temp\is-I4V94.tmp\Sun1966fb31dd5a07.tmp" /SL5="$50136,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS432868E2\Sun1966fb31dd5a07.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768

C:\Users\Admin\AppData\Local\Temp\is-5LD68.tmp\Ze2ro.exe
"C:\Users\Admin\AppData\Local\Temp\is-5LD68.tmp\Ze2ro.exe" /S /UID=burnerch2
7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2272

C:\Program Files\Uninstall Information\QCUQJISSCS\ultramediaburner.exe
"C:\Program Files\Uninstall Information\QCUQJISSCS\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
PID:1144

C:\Users\Admin\AppData\Local\Temp\is-M3ONH.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M3ONH.tmp\ultramediaburner.tmp" /SL5="$102EA,281924,62464,C:\Program Files\Uninstall Information\QCUQJISSCS\ultramediaburner.exe" /VERYSILENT
9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:3440

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
- Executes dropped EXE
PID:2684

C:\Users\Admin\AppData\Local\Temp\ab-2d741-bce-87986-8b13ae855e734\Rofuqiraeku.exe
"C:\Users\Admin\AppData\Local\Temp\ab-2d741-bce-87986-8b13ae855e734\Rofuqiraeku.exe"
8⤵
- Executes dropped EXE
PID:3720

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
9⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3364

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3364 CREDAT:275457 /prefetch:2
10⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2792

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3364 CREDAT:2176007 /prefetch:2
10⤵
PID:2656

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3364 CREDAT:2372620 /prefetch:2
10⤵
PID:8548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3364 CREDAT:668697 /prefetch:2
10⤵
PID:2988

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3364 CREDAT:1455158 /prefetch:2
10⤵
PID:8964

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
9⤵
PID:2996

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
9⤵
PID:8528

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
9⤵
PID:1788

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
9⤵
PID:9080

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
9⤵
PID:2632

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?id=1294231
9⤵
PID:9208

C:\Users\Admin\AppData\Local\Temp\9b-301a3-e31-c619a-2995303c2d27c\Jozhapygoce.exe
"C:\Users\Admin\AppData\Local\Temp\9b-301a3-e31-c619a-2995303c2d27c\Jozhapygoce.exe"
8⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3316

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h1eo3223.ryu\GcleanerEU.exe /eufive & exit
9⤵
PID:948

C:\Users\Admin\AppData\Local\Temp\h1eo3223.ryu\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\h1eo3223.ryu\GcleanerEU.exe /eufive
10⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\h1eo3223.ryu\GcleanerEU.exe" & exit
11⤵
PID:3532

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "GcleanerEU.exe" /f
12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Kills process with taskkill
PID:1752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z00hnvuv.rkd\installer.exe /qn CAMPAIGN="654" & exit
9⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\z00hnvuv.rkd\installer.exe
C:\Users\Admin\AppData\Local\Temp\z00hnvuv.rkd\installer.exe /qn CAMPAIGN="654"
10⤵
PID:3796

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\z00hnvuv.rkd\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\z00hnvuv.rkd\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632083287 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
11⤵
PID:2788

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nokpbatj.cek\anyname.exe & exit
9⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Users\Admin\AppData\Local\Temp\nokpbatj.cek\anyname.exe
C:\Users\Admin\AppData\Local\Temp\nokpbatj.cek\anyname.exe
10⤵
PID:1000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j2x1s1zf.44k\gcleaner.exe /mixfive & exit
9⤵
PID:588

C:\Users\Admin\AppData\Local\Temp\j2x1s1zf.44k\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\j2x1s1zf.44k\gcleaner.exe /mixfive
10⤵
- Executes dropped EXE
PID:1136

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\j2x1s1zf.44k\gcleaner.exe" & exit
11⤵
PID:4060

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "gcleaner.exe" /f
12⤵
- Kills process with taskkill
PID:2552

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:3784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3312

C:\Users\Admin\AppData\Local\Temp\9CEA.exe
C:\Users\Admin\AppData\Local\Temp\9CEA.exe
1⤵
- Executes dropped EXE
PID:864

C:\Users\Admin\AppData\Local\Temp\7D2B.exe
C:\Users\Admin\AppData\Local\Temp\7D2B.exe
1⤵
- Executes dropped EXE
PID:3324

C:\Users\Admin\AppData\Local\Temp\EB69.exe
C:\Users\Admin\AppData\Local\Temp\EB69.exe
1⤵
PID:2240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:3348

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2620

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3520

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C9DC31BA85B23796CE1BD0C1FCF8DB9F C
2⤵
PID:2168

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A7E9A8892422E07991C033271B2443F1
2⤵
PID:2392

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:2844

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 38A4E212B1AE01BB3CA720AD4E17DFD9 M Global\MSI0000
2⤵
PID:4056

C:\Users\Admin\AppData\Local\Temp\CC46.exe
C:\Users\Admin\AppData\Local\Temp\CC46.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Users\Admin\AppData\Local\Temp\F450.exe
C:\Users\Admin\AppData\Local\Temp\F450.exe
1⤵
PID:1212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\F450.exe"
2⤵
PID:4072

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:3016

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20210919203605.log C:\Windows\Logs\CBS\CbsPersist_20210919203605.cab
1⤵
PID:2944

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
1⤵
PID:888

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
1⤵
PID:2176

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
1⤵
PID:588

C:\Windows\system32\taskeng.exe
taskeng.exe {E1FC1D5C-1E14-4366-9BCF-CD02392492FF} S-1-5-21-2375386074-2889020035-839874990-1000:AFOWCZMM\Admin:Interactive:[1]
1⤵
PID:3848

C:\Users\Admin\AppData\Roaming\ievjrjh
C:\Users\Admin\AppData\Roaming\ievjrjh
2⤵
PID:3068

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
1⤵
PID:2408

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
1⤵
PID:3424

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
1⤵
PID:3468

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core
1⤵
PID:4236

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
1⤵
PID:8512

C:\Windows\system32\taskeng.exe
taskeng.exe {8463E549-E6C1-420B-9B50-273CA72C3C46} S-1-5-21-2375386074-2889020035-839874990-1000:AFOWCZMM\Admin:Interactive:[1]
1⤵
PID:8320

C:\Users\Admin\AppData\Roaming\ievjrjh
C:\Users\Admin\AppData\Roaming\ievjrjh
2⤵
PID:2372

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
1⤵
PID:4488

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
1⤵
PID:5544

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
1⤵
PID:5560

C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
1⤵
PID:5592

C:\Windows\system32\taskeng.exe
taskeng.exe {81D7B433-C2A4-43F5-911E-68562BE0F1A9} S-1-5-21-2375386074-2889020035-839874990-1000:AFOWCZMM\Admin:Interactive:[1]
1⤵
PID:5608

C:\Users\Admin\AppData\Roaming\ievjrjh
C:\Users\Admin\AppData\Roaming\ievjrjh
2⤵
PID:5688

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery