redline | 5e2bf564a4f985a7482d505def1ec79c92566bf7eda4724811ee29b9c4a66156

System Information Discovery

Processes:

xt_vwnQv2eQGmV4xbqeUC1Bz.exeMVo1J0xKZYOGfFa6iro27ySw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xt_vwnQv2eQGmV4xbqeUC1Bz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xt_vwnQv2eQGmV4xbqeUC1Bz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MVo1J0xKZYOGfFa6iro27ySw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MVo1J0xKZYOGfFa6iro27ySw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Fri10584c049c7f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Fri10584c049c7f.exe

Loads dropped DLL 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeFri1008c7d6874.exeFri10584c049c7f.execmd.exeFri10fcc13ae0125c8.exeFri106e757f6d75.exeFri1015b9a4e0b.execmd.execmd.execmd.execmd.exeFri10acd1e0a9e6.exeFri105268dda3.exeFri1034cd265b5e0adcd.exeFri10720d229511df563.exeFri10fcc13ae0125c8.tmpcmd.exeSkVPVS3t6Y8W.EXeFri106e757f6d75.exe

pid	process
1572	setup_x86_x64_install.exe
960	setup_installer.exe
960	setup_installer.exe
960	setup_installer.exe
960	setup_installer.exe
960	setup_installer.exe
960	setup_installer.exe
1172	setup_install.exe
1172	setup_install.exe
1172	setup_install.exe
1172	setup_install.exe
1172	setup_install.exe
1172	setup_install.exe
1172	setup_install.exe
1172	setup_install.exe
1056	cmd.exe
1856	cmd.exe
1216	cmd.exe
560	cmd.exe
1524	cmd.exe
1972	cmd.exe
1972	cmd.exe
1860	cmd.exe
1860	cmd.exe
1780	Fri1008c7d6874.exe
1780	Fri1008c7d6874.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1928	cmd.exe
1928	cmd.exe
368	Fri10fcc13ae0125c8.exe
368	Fri10fcc13ae0125c8.exe
1820	Fri106e757f6d75.exe
1820	Fri106e757f6d75.exe
1568	Fri1015b9a4e0b.exe
1568	Fri1015b9a4e0b.exe
1632	cmd.exe
1632	cmd.exe
1160	cmd.exe
988	cmd.exe
1744	cmd.exe
736	Fri10acd1e0a9e6.exe
736	Fri10acd1e0a9e6.exe
980	Fri105268dda3.exe
980	Fri105268dda3.exe
1424	Fri1034cd265b5e0adcd.exe
1424	Fri1034cd265b5e0adcd.exe
484	Fri10720d229511df563.exe
484	Fri10720d229511df563.exe
1068	Fri10fcc13ae0125c8.tmp
1068	Fri10fcc13ae0125c8.tmp
1068	Fri10fcc13ae0125c8.tmp
1068	Fri10fcc13ae0125c8.tmp
2280	cmd.exe
2332	SkVPVS3t6Y8W.EXe
2332	SkVPVS3t6Y8W.EXe
1644	Fri10584c049c7f.exe
1820	Fri106e757f6d75.exe
1820	Fri106e757f6d75.exe
2668	Fri106e757f6d75.exe
2668	Fri106e757f6d75.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri10d184202996a0d7f.exe	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

Sayma.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Reference Assemblies\\Quzhogyrygu.exe\""	Sayma.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

xt_vwnQv2eQGmV4xbqeUC1Bz.exeMVo1J0xKZYOGfFa6iro27ySw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xt_vwnQv2eQGmV4xbqeUC1Bz.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MVo1J0xKZYOGfFa6iro27ySw.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
40 ipinfo.io
42 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

xt_vwnQv2eQGmV4xbqeUC1Bz.exeMVo1J0xKZYOGfFa6iro27ySw.exe

pid process

2700 xt_vwnQv2eQGmV4xbqeUC1Bz.exe
2224 MVo1J0xKZYOGfFa6iro27ySw.exe

flow	ioc
15	ip-api.com
40	ipinfo.io
42	ipinfo.io

pid	process
2700	xt_vwnQv2eQGmV4xbqeUC1Bz.exe
2224	MVo1J0xKZYOGfFa6iro27ySw.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Fri106e757f6d75.exeTskYMxAHo9I4BMYToN5mxfs8.exeqpfVLiy6wF7LWXLp3rMETXIM.exe

description	pid	process	target process
PID 1820 set thread context of 2668	1820	Fri106e757f6d75.exe	Fri106e757f6d75.exe
PID 2568 set thread context of 2968	2568	TskYMxAHo9I4BMYToN5mxfs8.exe	TskYMxAHo9I4BMYToN5mxfs8.exe
PID 2256 set thread context of 2952	2256	qpfVLiy6wF7LWXLp3rMETXIM.exe	qpfVLiy6wF7LWXLp3rMETXIM.exe

Drops file in Program Files directory 9 IoCs

Processes:

ultramediaburner.tmpSayma.exe

description	ioc	process
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-HHFJM.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\Reference Assemblies\Quzhogyrygu.exe	Sayma.exe
File created	C:\Program Files (x86)\Reference Assemblies\Quzhogyrygu.exe.config	Sayma.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-RTLBT.tmp	ultramediaburner.tmp
File created	C:\Program Files\VideoLAN\SIFYVBRSCV\ultramediaburner.exe	Sayma.exe
File created	C:\Program Files\VideoLAN\SIFYVBRSCV\ultramediaburner.exe.config	Sayma.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2624 1508 WerFault.exe X_7TmEAqMoxxhBPV1vh6N_Qh.exe

pid	pid_target	process	target process
2624	1508	WerFault.exe	X_7TmEAqMoxxhBPV1vh6N_Qh.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Fri105268dda3.exeqpfVLiy6wF7LWXLp3rMETXIM.exedajradjdajradj

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	qpfVLiy6wF7LWXLp3rMETXIM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dajradj
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dajradj
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dajradj
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dajradj
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dajradj
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dajradj
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	qpfVLiy6wF7LWXLp3rMETXIM.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	qpfVLiy6wF7LWXLp3rMETXIM.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2356 taskkill.exe
2416 taskkill.exe
2692 taskkill.exe
1884 taskkill.exe

pid	process
2356	taskkill.exe
2416	taskkill.exe
2692	taskkill.exe
1884	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{008C2FC2-23DB-11EC-BA8C-DA23DD5773EE}.dat = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ja-JP = "ja-JP.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f45a3407a6eee4cb6062dddd85478a6000000000200000000001066000000010000200000005371975696a3bf724520b6fa2c4e0167e5fce673e4c5d7cb6bf54bb10fbfb555000000000e8000000002000020000000769925a96366fc0810dbbbe13541139b5b3d32d50c21d3bc1a5f610d4cb430b490000000228ea2f57cca276d89668c489f97e832a802f5308b8a6542f5bfeb3c84154b1486bb0782c6afa745e247fb55dc268e5e8da35985a91a8f50a946e62736cc4db9e42c5018ece3d857fad85ccddae88ed1da4ec38d34d55b1febd51e147efb247135252824736451e671fe4bd2f4a9baf67cc6a3185ca8628891d5fd360d9873e774bc6ea4730803e1b2f394f554d7bdf1400000000b59a5062a8a9bcd12bad87648762039adb48a0bdba7c565969f9fc1af0d1c0933c055e37523a9c4a7a514aaea6f80e764f1e9206300d032647a9893f1367db9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48C4E7E0-23DC-11EC-BA8C-DA23DD5773EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{008C2FC0-23DB-11EC-BA8C-DA23DD5773EE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Sayma.exeFri10720d229511df563.exeFri10b0a06a73706.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sayma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Fri10720d229511df563.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Fri10720d229511df563.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Fri10b0a06a73706.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Fri10b0a06a73706.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Fri10b0a06a73706.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sayma.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Fri10584c049c7f.exepowershell.exeFri105268dda3.exesDJuDKIL7hjaxVGsbNOqC5Zl.exe

pid	process
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1644	Fri10584c049c7f.exe
1312	powershell.exe
980	Fri105268dda3.exe
980	Fri105268dda3.exe
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe
1392
2484	sDJuDKIL7hjaxVGsbNOqC5Zl.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

WerFault.exeiexplore.exe

pid process

1392
2624 WerFault.exe
2708 iexplore.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

Fri105268dda3.exedajradjdajradjqpfVLiy6wF7LWXLp3rMETXIM.exe

pid process

980 Fri105268dda3.exe
2204 dajradj
2348 dajradj
2952 qpfVLiy6wF7LWXLp3rMETXIM.exe

pid	process
1392
2624	WerFault.exe
2708	iexplore.exe

pid	process
980	Fri105268dda3.exe
2204	dajradj
2348	dajradj
2952	qpfVLiy6wF7LWXLp3rMETXIM.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

Processes:

Fri10720d229511df563.exepowershell.exeFri10b0a06a73706.exetaskkill.exetaskkill.exetaskkill.exeFri1015b9a4e0b.exeFri106e757f6d75.exeFri103a7805577.exetaskkill.exeTskYMxAHo9I4BMYToN5mxfs8.exeWerFault.exe

description	pid	process
Token: SeCreateTokenPrivilege	484	Fri10720d229511df563.exe
Token: SeAssignPrimaryTokenPrivilege	484	Fri10720d229511df563.exe
Token: SeLockMemoryPrivilege	484	Fri10720d229511df563.exe
Token: SeIncreaseQuotaPrivilege	484	Fri10720d229511df563.exe
Token: SeMachineAccountPrivilege	484	Fri10720d229511df563.exe
Token: SeTcbPrivilege	484	Fri10720d229511df563.exe
Token: SeSecurityPrivilege	484	Fri10720d229511df563.exe
Token: SeTakeOwnershipPrivilege	484	Fri10720d229511df563.exe
Token: SeLoadDriverPrivilege	484	Fri10720d229511df563.exe
Token: SeSystemProfilePrivilege	484	Fri10720d229511df563.exe
Token: SeSystemtimePrivilege	484	Fri10720d229511df563.exe
Token: SeProfSingleProcessPrivilege	484	Fri10720d229511df563.exe
Token: SeIncBasePriorityPrivilege	484	Fri10720d229511df563.exe
Token: SeCreatePagefilePrivilege	484	Fri10720d229511df563.exe
Token: SeCreatePermanentPrivilege	484	Fri10720d229511df563.exe
Token: SeBackupPrivilege	484	Fri10720d229511df563.exe
Token: SeRestorePrivilege	484	Fri10720d229511df563.exe
Token: SeShutdownPrivilege	484	Fri10720d229511df563.exe
Token: SeDebugPrivilege	484	Fri10720d229511df563.exe
Token: SeAuditPrivilege	484	Fri10720d229511df563.exe
Token: SeSystemEnvironmentPrivilege	484	Fri10720d229511df563.exe
Token: SeChangeNotifyPrivilege	484	Fri10720d229511df563.exe
Token: SeRemoteShutdownPrivilege	484	Fri10720d229511df563.exe
Token: SeUndockPrivilege	484	Fri10720d229511df563.exe
Token: SeSyncAgentPrivilege	484	Fri10720d229511df563.exe
Token: SeEnableDelegationPrivilege	484	Fri10720d229511df563.exe
Token: SeManageVolumePrivilege	484	Fri10720d229511df563.exe
Token: SeImpersonatePrivilege	484	Fri10720d229511df563.exe
Token: SeCreateGlobalPrivilege	484	Fri10720d229511df563.exe
Token: 31	484	Fri10720d229511df563.exe
Token: 32	484	Fri10720d229511df563.exe
Token: 33	484	Fri10720d229511df563.exe
Token: 34	484	Fri10720d229511df563.exe
Token: 35	484	Fri10720d229511df563.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	1960	Fri10b0a06a73706.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeShutdownPrivilege	1392
Token: SeDebugPrivilege	2692	taskkill.exe
Token: SeDebugPrivilege	1568	Fri1015b9a4e0b.exe
Token: SeDebugPrivilege	2668	Fri106e757f6d75.exe
Token: SeDebugPrivilege	1792	Fri103a7805577.exe
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	2568	TskYMxAHo9I4BMYToN5mxfs8.exe
Token: SeDebugPrivilege	2624	WerFault.exe
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392
Token: SeShutdownPrivilege	1392

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exeultramediaburner.tmpiexplore.exeiexplore.exe

pid process

1392
1392
2708 iexplore.exe
1652 ultramediaburner.tmp
2708 iexplore.exe
1748 iexplore.exe
2028 iexplore.exe
Suspicious use of SendNotifyMessage 8 IoCs

Processes:

pid process

1392
1392
1392
1392
1392
1392
1392
1392

pid	process
1392
1392
2708	iexplore.exe
1652	ultramediaburner.tmp
2708	iexplore.exe
1748	iexplore.exe
2028	iexplore.exe

pid	process
1392
1392
1392
1392
1392
1392
1392
1392

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

pid	process
2708	iexplore.exe
2708	iexplore.exe
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1568	iexplore.exe
1568	iexplore.exe
3000	IEXPLORE.EXE
3000	IEXPLORE.EXE
1368	iexplore.exe
1368	iexplore.exe
2708	iexplore.exe
2708	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
1748	iexplore.exe
1748	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2028	iexplore.exe
2028	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.exe

description	pid	process	target process
PID 1572 wrote to memory of 960	1572	setup_x86_x64_install.exe	setup_installer.exe
PID 1572 wrote to memory of 960	1572	setup_x86_x64_install.exe	setup_installer.exe
PID 1572 wrote to memory of 960	1572	setup_x86_x64_install.exe	setup_installer.exe
PID 1572 wrote to memory of 960	1572	setup_x86_x64_install.exe	setup_installer.exe
PID 1572 wrote to memory of 960	1572	setup_x86_x64_install.exe	setup_installer.exe
PID 1572 wrote to memory of 960	1572	setup_x86_x64_install.exe	setup_installer.exe
PID 1572 wrote to memory of 960	1572	setup_x86_x64_install.exe	setup_installer.exe
PID 960 wrote to memory of 1172	960	setup_installer.exe	setup_install.exe
PID 960 wrote to memory of 1172	960	setup_installer.exe	setup_install.exe
PID 960 wrote to memory of 1172	960	setup_installer.exe	setup_install.exe
PID 960 wrote to memory of 1172	960	setup_installer.exe	setup_install.exe
PID 960 wrote to memory of 1172	960	setup_installer.exe	setup_install.exe
PID 960 wrote to memory of 1172	960	setup_installer.exe	setup_install.exe
PID 960 wrote to memory of 1172	960	setup_installer.exe	setup_install.exe
PID 1172 wrote to memory of 636	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 636	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 636	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 636	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 636	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 636	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 636	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1744	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1524	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1524	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1524	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1524	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1524	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1524	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1524	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1056	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1056	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1056	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1056	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1056	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1056	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1056	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1972	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1972	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1972	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1972	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1972	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1972	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1972	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1860	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1860	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1860	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1860	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1860	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1860	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1860	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1216	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1216	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1216	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1216	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1216	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1216	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1216	1172	setup_install.exe	cmd.exe
PID 1172 wrote to memory of 1856	1172	setup_install.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
PID:636

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1034cd265b5e0adcd.exe
4⤵
- Loads dropped DLL
PID:1744

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri1034cd265b5e0adcd.exe
Fri1034cd265b5e0adcd.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri1034cd265b5e0adcd.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri1034cd265b5e0adcd.exe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
6⤵
PID:1168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri1034cd265b5e0adcd.exe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri1034cd265b5e0adcd.exe" ) do taskkill -F -Im "%~nXU"
7⤵
- Loads dropped DLL
PID:2280

C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
9⤵
PID:2396

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
10⤵
PID:2580

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCRipT:CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
9⤵
PID:2960

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
10⤵
PID:808

C:\Windows\SysWOW64\taskkill.exe
taskkill -F -Im "Fri1034cd265b5e0adcd.exe"
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10584c049c7f.exe
4⤵
- Loads dropped DLL
PID:1524

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri10584c049c7f.exe
Fri10584c049c7f.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1644

C:\Users\Admin\Documents\sDJuDKIL7hjaxVGsbNOqC5Zl.exe
"C:\Users\Admin\Documents\sDJuDKIL7hjaxVGsbNOqC5Zl.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2484

C:\Users\Admin\Documents\ZwOm4inWAm4xbs6zmdV2mVap.exe
"C:\Users\Admin\Documents\ZwOm4inWAm4xbs6zmdV2mVap.exe"
6⤵
- Executes dropped EXE
PID:1736

C:\Users\Admin\Documents\Ck7D4yLhDznwvCJsiauCAICG.exe
"C:\Users\Admin\Documents\Ck7D4yLhDznwvCJsiauCAICG.exe"
6⤵
- Executes dropped EXE
PID:1628

C:\Users\Admin\Documents\xt_vwnQv2eQGmV4xbqeUC1Bz.exe
"C:\Users\Admin\Documents\xt_vwnQv2eQGmV4xbqeUC1Bz.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2700

C:\Users\Admin\Documents\Xv5upkarddb6Yc1iGsroZjcf.exe
"C:\Users\Admin\Documents\Xv5upkarddb6Yc1iGsroZjcf.exe"
6⤵
- Executes dropped EXE
PID:2760

C:\Users\Admin\Documents\0j69mHyD7PXhSptdct3wOdXp.exe
"C:\Users\Admin\Documents\0j69mHyD7PXhSptdct3wOdXp.exe"
6⤵
- Executes dropped EXE
PID:2684

C:\Users\Admin\Documents\R47UmwLCYSmTW7VaUKzC6RVH.exe
"C:\Users\Admin\Documents\R47UmwLCYSmTW7VaUKzC6RVH.exe"
6⤵
- Executes dropped EXE
PID:2620

C:\Users\Admin\Documents\alesmTgWIUAJg_NkaoUsPTQs.exe
"C:\Users\Admin\Documents\alesmTgWIUAJg_NkaoUsPTQs.exe"
6⤵
PID:2664

C:\Users\Admin\Documents\ZCTRZNgArJAhVVO7K7ES9DIp.exe
"C:\Users\Admin\Documents\ZCTRZNgArJAhVVO7K7ES9DIp.exe"
6⤵
- Executes dropped EXE
PID:2632

C:\Users\Admin\Documents\PD1WQrTuTMiOO9MFntNUeQ39.exe
"C:\Users\Admin\Documents\PD1WQrTuTMiOO9MFntNUeQ39.exe"
6⤵
- Executes dropped EXE
PID:2516

C:\Users\Admin\Documents\qpfVLiy6wF7LWXLp3rMETXIM.exe
"C:\Users\Admin\Documents\qpfVLiy6wF7LWXLp3rMETXIM.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2256

C:\Users\Admin\Documents\qpfVLiy6wF7LWXLp3rMETXIM.exe
"C:\Users\Admin\Documents\qpfVLiy6wF7LWXLp3rMETXIM.exe"
7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2952

C:\Users\Admin\Documents\MVo1J0xKZYOGfFa6iro27ySw.exe
"C:\Users\Admin\Documents\MVo1J0xKZYOGfFa6iro27ySw.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2224

C:\Users\Admin\Documents\NCanyfE3mYfnwbU5RbqSyEnS.exe
"C:\Users\Admin\Documents\NCanyfE3mYfnwbU5RbqSyEnS.exe"
6⤵
- Executes dropped EXE
PID:2588

C:\Users\Admin\Documents\QTBBAbaSoKt95GwkK5NnmIaG.exe
"C:\Users\Admin\Documents\QTBBAbaSoKt95GwkK5NnmIaG.exe"
6⤵
- Executes dropped EXE
PID:968

C:\Users\Admin\Documents\jrk0yPJhj7SXU63RqS9Z9xRE.exe
"C:\Users\Admin\Documents\jrk0yPJhj7SXU63RqS9Z9xRE.exe"
6⤵
- Executes dropped EXE
PID:548

C:\Users\Admin\Documents\X_7TmEAqMoxxhBPV1vh6N_Qh.exe
"C:\Users\Admin\Documents\X_7TmEAqMoxxhBPV1vh6N_Qh.exe"
6⤵
- Executes dropped EXE
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1384
7⤵
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Users\Admin\Documents\xBZoBc6C5t_n39CkMXqfJfkr.exe
"C:\Users\Admin\Documents\xBZoBc6C5t_n39CkMXqfJfkr.exe"
6⤵
- Executes dropped EXE
PID:2644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "xBZoBc6C5t_n39CkMXqfJfkr.exe" /f & erase "C:\Users\Admin\Documents\xBZoBc6C5t_n39CkMXqfJfkr.exe" & exit
7⤵
PID:1408

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "xBZoBc6C5t_n39CkMXqfJfkr.exe" /f
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Users\Admin\Documents\vh1lWSFHikKam1DabTFMLtd9.exe
"C:\Users\Admin\Documents\vh1lWSFHikKam1DabTFMLtd9.exe"
6⤵
- Executes dropped EXE
PID:2132

C:\Users\Admin\Documents\6GyRq93SHYpEJQn1duCspoGl.exe
"C:\Users\Admin\Documents\6GyRq93SHYpEJQn1duCspoGl.exe"
6⤵
- Executes dropped EXE
PID:2812

C:\Users\Admin\Documents\TskYMxAHo9I4BMYToN5mxfs8.exe
"C:\Users\Admin\Documents\TskYMxAHo9I4BMYToN5mxfs8.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Users\Admin\Documents\TskYMxAHo9I4BMYToN5mxfs8.exe
"C:\Users\Admin\Documents\TskYMxAHo9I4BMYToN5mxfs8.exe"
7⤵
PID:1808

C:\Users\Admin\Documents\TskYMxAHo9I4BMYToN5mxfs8.exe
"C:\Users\Admin\Documents\TskYMxAHo9I4BMYToN5mxfs8.exe"
7⤵
- Executes dropped EXE
PID:2968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10b0a06a73706.exe
4⤵
- Loads dropped DLL
PID:1056

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri10b0a06a73706.exe
Fri10b0a06a73706.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1015b9a4e0b.exe
4⤵
- Loads dropped DLL
PID:1972

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri1015b9a4e0b.exe
Fri1015b9a4e0b.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri106e757f6d75.exe
4⤵
- Loads dropped DLL
PID:1860

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri106e757f6d75.exe
Fri106e757f6d75.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1820

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri106e757f6d75.exe
C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri106e757f6d75.exe
6⤵
- Executes dropped EXE
PID:2512

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri106e757f6d75.exe
C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri106e757f6d75.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri103a7805577.exe
4⤵
- Loads dropped DLL
PID:1856

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri103a7805577.exe
Fri103a7805577.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
- Executes dropped EXE
PID:2528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1018ef4aa251c026c.exe
4⤵
- Loads dropped DLL
PID:1160

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri1018ef4aa251c026c.exe
Fri1018ef4aa251c026c.exe
5⤵
- Executes dropped EXE
PID:284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1008c7d6874.exe
4⤵
- Loads dropped DLL
PID:1216

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri1008c7d6874.exe
Fri1008c7d6874.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10d184202996a0d7f.exe
4⤵
PID:1164

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10720d229511df563.exe
4⤵
- Loads dropped DLL
PID:988

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri10720d229511df563.exe
Fri10720d229511df563.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:484

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:2344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri105268dda3.exe
4⤵
- Loads dropped DLL
PID:1928

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri105268dda3.exe
Fri105268dda3.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10fcc13ae0125c8.exe
4⤵
- Loads dropped DLL
PID:560

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri10fcc13ae0125c8.exe
Fri10fcc13ae0125c8.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:368

C:\Users\Admin\AppData\Local\Temp\is-54LDU.tmp\Fri10fcc13ae0125c8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-54LDU.tmp\Fri10fcc13ae0125c8.tmp" /SL5="$50132,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri10fcc13ae0125c8.exe"
6⤵
- Loads dropped DLL
PID:1068

C:\Users\Admin\AppData\Local\Temp\is-GCL16.tmp\Sayma.exe
"C:\Users\Admin\AppData\Local\Temp\is-GCL16.tmp\Sayma.exe" /S /UID=burnerch2
7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
PID:2168

C:\Program Files\VideoLAN\SIFYVBRSCV\ultramediaburner.exe
"C:\Program Files\VideoLAN\SIFYVBRSCV\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
PID:2728

C:\Users\Admin\AppData\Local\Temp\is-SBR9C.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-SBR9C.tmp\ultramediaburner.tmp" /SL5="$202A6,281924,62464,C:\Program Files\VideoLAN\SIFYVBRSCV\ultramediaburner.exe" /VERYSILENT
9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1652

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
- Executes dropped EXE
PID:2384

C:\Users\Admin\AppData\Local\Temp\38-3a213-63d-99ab4-dd86accacbd3e\Gaemashufoku.exe
"C:\Users\Admin\AppData\Local\Temp\38-3a213-63d-99ab4-dd86accacbd3e\Gaemashufoku.exe"
8⤵
- Executes dropped EXE
PID:2124

C:\Users\Admin\AppData\Local\Temp\39-4819b-628-919b6-a2eebbdb760c6\Venokyjihae.exe
"C:\Users\Admin\AppData\Local\Temp\39-4819b-628-919b6-a2eebbdb760c6\Venokyjihae.exe"
8⤵
- Executes dropped EXE
PID:2176

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
9⤵
PID:688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
9⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2708

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
10⤵
- Suspicious use of SetWindowsHookEx
PID:1100

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:340994 /prefetch:2
10⤵
- Suspicious use of SetWindowsHookEx
PID:3000

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:537611 /prefetch:2
10⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1568 CREDAT:275457 /prefetch:2
10⤵
PID:2228

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
9⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
10⤵
PID:2212

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
9⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1748

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
10⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
9⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
10⤵
- Suspicious use of SetWindowsHookEx
PID:2788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10acd1e0a9e6.exe /mixone
4⤵
- Loads dropped DLL
PID:1632

C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri10acd1e0a9e6.exe
Fri10acd1e0a9e6.exe /mixone
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Fri10acd1e0a9e6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0C3AF623\Fri10acd1e0a9e6.exe" & exit
6⤵
PID:2624

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Fri10acd1e0a9e6.exe" /f
7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Users\Admin\AppData\Local\Temp\F99A.exe
C:\Users\Admin\AppData\Local\Temp\F99A.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Users\Admin\AppData\Local\Temp\3B2C.exe
C:\Users\Admin\AppData\Local\Temp\3B2C.exe
1⤵
- Executes dropped EXE
PID:2164

C:\Users\Admin\AppData\Local\Temp\AC57.exe
C:\Users\Admin\AppData\Local\Temp\AC57.exe
1⤵
- Executes dropped EXE
PID:868

C:\Windows\system32\taskeng.exe
taskeng.exe {ED299F73-4482-4FC9-924D-FE115AB9382A} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:2208

C:\Users\Admin\AppData\Roaming\dajradj
C:\Users\Admin\AppData\Roaming\dajradj
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2204

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:2768

C:\Users\Admin\AppData\Roaming\dajradj
C:\Users\Admin\AppData\Roaming\dajradj
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2348

C:\Users\Admin\AppData\Roaming\ftjradj
C:\Users\Admin\AppData\Roaming\ftjradj
2⤵
- Executes dropped EXE
PID:2764

C:\Users\Admin\AppData\Roaming\dajradj
C:\Users\Admin\AppData\Roaming\dajradj
2⤵
- Executes dropped EXE
PID:1836

C:\Windows\system32\taskeng.exe
taskeng.exe {325114D8-4026-434E-A12F-432F88412B6E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\42BE.exe
C:\Users\Admin\AppData\Local\Temp\42BE.exe
1⤵
- Executes dropped EXE
PID:2880

C:\Users\Admin\AppData\Local\Temp\28D9.exe
C:\Users\Admin\AppData\Local\Temp\28D9.exe
1⤵
- Executes dropped EXE
PID:2252

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery